CVE Tools
Track your stack

Apache-software-foundation

2,749 CVEs tracked since 2006. Since Oct 2021, 19 of them reached CISA KEV.

Apache-software-foundation CVEs per month

Oct 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Apache-software-foundation CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-10172
2021-11250
2021-12173
2022-01320
2022-02141
2022-03120
2022-04131
2022-05100
2022-06180
2022-07131
2022-08260
2022-09300
2022-10200
2022-11280
2022-12210
2023-01250
2023-02160
2023-03no snapshot
2023-04211
2023-05311
2023-06180
2023-07290
2023-08170
2023-09170
2023-10262
2023-11280
2023-12240
2024-01150
2024-02380
2024-03290
2024-04271
2024-0581
2024-06120
2024-07461
2024-08181
2024-09141
2024-10150
2024-11250
2024-12170
2025-01160
2025-02150
2025-03231
2025-04190
2025-05150
2025-06210
2025-07240
2025-08210
2025-09120
2025-10200
2025-11190
2025-12220
2026-01220
2026-02250
2026-03200
2026-04861
2026-05870
2026-061210
2026-071810
2026-081670
2026-091950
2026-101620

Products

The products that kept showing up in Apache-software-foundation's monthly top three, with their CVEs summed over those months.

  1. Apache Airflow9315 months
  2. Apache HTTP Server9011 months
  3. Apache Thrift843 months
  4. Apache Traffic Server637 months
  5. HTTP Server548 months
  6. Apache Superset448 months
  7. Apache Cloudstack346 months
  8. Apache Tomcat336 months
  9. Apache Ofbiz295 months
  10. Airflow277 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache-software-foundation.

  1. CVE-2026-113582Apache Abdera: XML external entity expansion in Atom document parsing7.5
  2. CVE-2026-103634Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch—
  3. CVE-2026-112381Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response5.9
  4. CVE-2026-111817Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout5.3
  5. CVE-2026-111812Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials10.0
  6. CVE-2026-111811Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication9.0
  7. CVE-2026-111809Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling9.3
  8. CVE-2026-111810Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service7.5
  9. CVE-2026-111815Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement10.0
  10. CVE-2026-111814Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin10.0
  11. CVE-2026-111808Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion8.6
  12. CVE-2026-111805Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion8.6
  13. CVE-2026-111816Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out9.3
  14. CVE-2025-55702Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request8.7
  15. CVE-2025-31699Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling8.9

The record

Peak rank
#5 in Jul 2026
Busiest month shown
Sep 2026, 195 CVEs
Months with a KEV entry
15 since Oct 2021
Monthly snapshots
141 since 2006
Apache-software-foundation's full record, month by month