How many CVEs does Apache Software Foundation have?

Apache Software Foundation has 3,814 published CVE records since 1999, including 1,287 in the last two years.

How many Apache Software Foundation CVEs are in CISA KEV?

Yes — 46 of Apache Software Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Apache Software Foundation products have the most CVEs?

The Apache Software Foundation products with the most published CVEs are http_server, Tomcat, Airflow, Apache Airflow, apache-airflow.

What are the most common weakness types in Apache Software Foundation CVEs?

Apache Software Foundation's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-502 (Deserialization of Untrusted Data), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How many critical Apache Software Foundation vulnerabilities are there?

Apache Software Foundation has 725 critical and 1,433 high-severity CVEs.

What is the average severity of Apache Software Foundation CVEs?

The average CVSS base score across Apache Software Foundation's scored CVEs is 7.1.

Apache Software Foundation Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Apache Software Foundation vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

Apache Software Foundation has 3,814 published CVE records since 1999, of which 46 are in CISA's Known Exploited Vulnerabilities catalog and 566 have a known public exploit. The average CVSS base score across scored CVEs is 7.1.

Security scorecard

A quick read on Apache Software Foundation's vulnerability posture, as a share of its 3,814 published CVEs.

Average CVSS: 7.1
Critical / high: 57%
Actively exploited (KEV): 1%
Public exploit available: 15%
Patch available: 89%

Severity and exploitation

How the CVSS severity of Apache Software Foundation's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical725

High1,433

Medium1,514

Low129

13 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

46 of Apache Software Foundation's CVEs are confirmed exploited in the wild.

Public exploits

566

566 of Apache Software Foundation's CVEs have a known public exploit available.

Most affected products

The Apache Software Foundation products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Apache Software Foundation CVE records.

Disclosure activity by year

How many Apache Software Foundation CVEs were published each year.

2019

172

2020

167

2021

211

2022

224

2023

302

2024

267

2025

Latest Apache Software Foundation CVEs

The most recently disclosed vulnerabilities affecting Apache Software Foundation.

Apache Kylin: spark job OS command injection
CWE-78
Unscored
2026-10-16
Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
Unscored
2026-10-16
Apache Kylin: Broken Access Control in QuerySQLBlacklistController
CWE-200
Unscored
2026-10-16
Apache Kylin: JobController allows unauthorized cross-project manipulation
CWE-200

Other vendors

CVE counts for other vendors.

siemens4,591 CVEs canonical4,352 CVEs mozilla4,067 CVEs openSUSE3,321 CVEs Qualcomm3,079 CVEs HP2,542 CVEs Netapp2,529 CVEs Huawei2,409 CVEs

Browse all vendors

Frequently asked questions

Common questions about Apache Software Foundation vulnerabilities.

How many CVEs does Apache Software Foundation have?: Apache Software Foundation has 3,814 published CVE records since 1999, including 1,287 in the last two years.
How many Apache Software Foundation CVEs are in CISA KEV?: Yes — 46 of Apache Software Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Apache Software Foundation products have the most CVEs?: The Apache Software Foundation products with the most published CVEs are http_server, Tomcat, Airflow, Apache Airflow, apache-airflow.
What are the most common weakness types in Apache Software Foundation CVEs?: Apache Software Foundation's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-502 (Deserialization of Untrusted Data), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Are there public exploits for Apache Software Foundation vulnerabilities?: Yes — 566 of Apache Software Foundation's CVEs have a known public exploit.
How many critical Apache Software Foundation vulnerabilities are there?: Apache Software Foundation has 725 critical and 1,433 high-severity CVEs.
What is the average severity of Apache Software Foundation CVEs?: The average CVSS base score across Apache Software Foundation's scored CVEs is 7.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation vulnerabilities

Get an alert for each new Apache Software Foundation CVE, with AI-written analysis and remediation steps.

Create an account See pricing