How many CVEs does Apache Software Foundation have?

Apache Software Foundation has 3,458 published CVE records since 1999, including 931 in the last two years.

How many Apache Software Foundation CVEs are in CISA KEV?

Yes — 45 of Apache Software Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Apache Software Foundation products have the most CVEs?

The Apache Software Foundation products with the most published CVEs are http_server, Tomcat, Airflow, Apache Airflow, apache-airflow.

What are the most common weakness types in Apache Software Foundation CVEs?

Apache Software Foundation's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-502 (Deserialization of Untrusted Data), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How many critical Apache Software Foundation vulnerabilities are there?

Apache Software Foundation has 651 critical and 1,264 high-severity CVEs.

What is the average severity of Apache Software Foundation CVEs?

The average CVSS base score across Apache Software Foundation's scored CVEs is 7.0.

Apache Software Foundation Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Apache Software Foundation vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

Apache Software Foundation has 3,458 published CVE records since 1999, of which 45 are in CISA's Known Exploited Vulnerabilities catalog and 390 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Apache Software Foundation's vulnerability posture, as a share of its 3,458 published CVEs.

Average CVSS: 7.0
Critical / high: 55%
Actively exploited (KEV): 1%
Public exploit available: 11%
Patch available: 91%

Severity and exploitation

How the CVSS severity of Apache Software Foundation's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical651

High1,264

Medium1,420

Low122

1 additional CVE has no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

45 of Apache Software Foundation's CVEs are confirmed exploited in the wild.

Public exploits

390

390 of Apache Software Foundation's CVEs have a known public exploit available.

Most affected products

The Apache Software Foundation products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Apache Software Foundation CVE records.

Disclosure activity by year

How many Apache Software Foundation CVEs were published each year.

2019

172

2020

167

2021

211

2022

224

2023

302

2024

267

2025

Latest Apache Software Foundation CVEs

The most recently disclosed vulnerabilities affecting Apache Software Foundation.

Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
CWE-79
Medium · CVSS 6.1
EPSS 0.3%2026-08-31
Apache Wicket: XSS in Palette via getAdditionalAttributes
CWE-79
Medium · CVSS 5.1
EPSS 0.4%2026-08-31
Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
CWE-79
Medium · CVSS 5.1
EPSS 0.4%2026-08-31
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute

Other vendors

Browse vulnerabilities for other tracked vendors.

canonical4,340 CVEs mozilla3,820 CVEs siemens3,667 CVEs openSUSE3,317 CVEs Qualcomm3,044 CVEs HP2,529 CVEs Netapp2,522 CVEs Huawei2,393 CVEs

Browse all vendors

Frequently asked questions

Common questions about Apache Software Foundation vulnerabilities.

How many CVEs does Apache Software Foundation have?: Apache Software Foundation has 3,458 published CVE records since 1999, including 931 in the last two years.
How many Apache Software Foundation CVEs are in CISA KEV?: Yes — 45 of Apache Software Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Apache Software Foundation products have the most CVEs?: The Apache Software Foundation products with the most published CVEs are http_server, Tomcat, Airflow, Apache Airflow, apache-airflow.
What are the most common weakness types in Apache Software Foundation CVEs?: Apache Software Foundation's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-502 (Deserialization of Untrusted Data), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Are there public exploits for Apache Software Foundation vulnerabilities?: Yes — 390 of Apache Software Foundation's CVEs have a known public exploit.
How many critical Apache Software Foundation vulnerabilities are there?: Apache Software Foundation has 651 critical and 1,264 high-severity CVEs.
What is the average severity of Apache Software Foundation CVEs?: The average CVSS base score across Apache Software Foundation's scored CVEs is 7.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation vulnerabilities

Monitor new Apache Software Foundation vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing