CVE Tools
Track your stack

Apache-software-foundation

2,955 CVEs tracked since 2006. Since Nov 2021, 17 of them reached CISA KEV.

Apache-software-foundation CVEs per month

Nov 2021 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Apache-software-foundation CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-11250
2021-12173
2022-01320
2022-02141
2022-03120
2022-04131
2022-05100
2022-06180
2022-07131
2022-08260
2022-09300
2022-10200
2022-11280
2022-12210
2023-01250
2023-02160
2023-03no snapshot
2023-04211
2023-05311
2023-06180
2023-07290
2023-08170
2023-09170
2023-10262
2023-11280
2023-12240
2024-01150
2024-02380
2024-03290
2024-04271
2024-0581
2024-06120
2024-07461
2024-08181
2024-09141
2024-10150
2024-11250
2024-12170
2025-01160
2025-02150
2025-03231
2025-04190
2025-05150
2025-06210
2025-07240
2025-08210
2025-09120
2025-10200
2025-11190
2025-12220
2026-01220
2026-02250
2026-03200
2026-04861
2026-05870
2026-061210
2026-071810
2026-081670
2026-091950
2026-103490
2026-11190

Products

The products that kept showing up in Apache-software-foundation's monthly top three, with their CVEs summed over those months.

  1. Apache Airflow9315 months
  2. Apache Thrift853 months
  3. Apache Camel692 months
  4. Apache HTTP Server679 months
  5. Apache Traffic Server637 months
  6. HTTP Server548 months
  7. Apache Superset448 months
  8. Apache Brpc351 month
  9. Apache Cloudstack346 months
  10. Apache Tomcat336 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache-software-foundation.

  1. CVE-2026-66903Apache OFBiz: Authenticated Path Traversal in Catalog Image Management—
  2. CVE-2026-71901Apache OFBiz: Dispatch arbitrary internal services on SFA component—
  3. CVE-2026-68524Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading—
  4. CVE-2026-73577Apache OFBiz: Unauthenticated path-suffix view authorization bypass—
  5. CVE-2026-73578Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact—
  6. CVE-2026-73580Apache OFBiz: Unauthenticated HR organization and employee disclosure—
  7. CVE-2026-74841Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode—
  8. CVE-2026-76150Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage—
  9. CVE-2026-81734Apache OFBiz: Missing authorization - catalog quick-admin product writes—
  10. CVE-2026-76152Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services—
  11. CVE-2026-81744Apache OFBiz: Authorization bypass - self-grant content OWNER—
  12. CVE-2026-81808Apache OFBiz: Missing authorization - search-result bulk catalog mutation—
  13. CVE-2026-81815Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB—
  14. CVE-2026-81816Apache OFBiz: XML external entity injection (XXE)—
  15. CVE-2026-81828Apache OFBiz: Server-side request forgery in SurveyWrapper—

The record

Peak rank
#3 in Nov 2026
Busiest month shown
Oct 2026, 349 CVEs
Months with a KEV entry
14 since Nov 2021
Monthly snapshots
142 since 2006
Apache-software-foundation's full record, month by month