How many CVEs does Apache Software Foundation have?

Apache Software Foundation has 3,182 published CVE records since 1999, including 660 in the last two years.

How many Apache Software Foundation CVEs are in CISA KEV?

Yes — 44 of Apache Software Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Apache Software Foundation products have the most CVEs?

The Apache Software Foundation products with the most published CVEs are http_server, Tomcat, Airflow, Apache Airflow, Apache HTTP Server.

What are the most common weakness types in Apache Software Foundation CVEs?

Apache Software Foundation's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-502 (Deserialization of Untrusted Data), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How many critical Apache Software Foundation vulnerabilities are there?

Apache Software Foundation has 610 critical and 1,129 high-severity CVEs.

What is the average severity of Apache Software Foundation CVEs?

The average CVSS base score across Apache Software Foundation's scored CVEs is 7.0.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

3,182 CVEs

44 in CISA KEV

Apache Software Foundation Vulnerabilities

Name: Apache Software Foundation vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Apache Software Foundation.

3,182

Total CVEs

Published

44

In CISA KEV

Exploited in the wild

448

Public exploits

PoC or exploit code

7.0

Avg CVSS

1999–2026

Overview

Apache Software Foundation has 3,182 published CVE records since 1999, of which 44 are in CISA's Known Exploited Vulnerabilities catalog and 448 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Apache Software Foundation's vulnerability posture, as a share of its 3,182 published CVEs.

Average CVSS: 7.0
Critical / high: 55%
Actively exploited (KEV): 1%
Public exploit available: 14%
Patch available: 90%

Severity and exploitation

How the CVSS severity of Apache Software Foundation's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical610

High1,129

Medium1,347

Low94

2 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

44

44 of Apache Software Foundation's CVEs are confirmed exploited in the wild.

Public exploits

448

448 of Apache Software Foundation's CVEs have a known public exploit available.

Most affected products

The Apache Software Foundation products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Apache Software Foundation CVE records.

Disclosure activity by year

How many Apache Software Foundation CVEs were published each year.

2019

172

2020

167

2021

211

2022

223

2023

302

2024

267

2025

221

2026

439

Latest Apache Software Foundation CVEs

The most recently disclosed vulnerabilities affecting Apache Software Foundation.

Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions
CWE-400
Unscored
2026-07-18
Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions
CWE-274
Medium · CVSS 5.7
EPSS 0.3%2026-07-17
Apache Ivy: PackagerResolver path traversal vulnerability
CWE-22
Medium · CVSS 5.4
EPSS 0.6%2026-07-15
Apache Fineract: Office list: SQL Injection via Subquery in orderBy
CWE-89
High · CVSS 8.1
EPSS 0.8%2026-07-15
Apache Fineract: SQL injection in runreports endpoint
CWE-89
High · CVSS 8.8
EPSS 3.5%2026-07-15
Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure
CWE-89
High · CVSS 8.1
EPSS 0.7%2026-07-15
Apache OpenMeetings: Arbitrary File Read
CWE-22
Medium · CVSS 6.5
EPSS 0.7%2026-07-14
Apache Kylin: Improper authorization in job information retrieval
CWE-280
Medium · CVSS 4.3
EPSS 0.5%2026-07-14
Apache Kylin: OS Command Injection via Async Query API
CWE-78
Critical · CVSS 9.8
EPSS 1.8%2026-07-14
Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
CWE-89
Critical · CVSS 9.8
EPSS 0.7%2026-07-14
Apache Doris: Improper Authentication in Frontend HTTP API
CWE-306
Critical · CVSS 9.1
EPSS 0.6%2026-07-14
Apache Tomcat: EncryptInterceptor requirements not clearly documented
CWE-1059
Critical · CVSS 9.1
EPSS 0.4%2026-07-14

Track new Apache Software Foundation CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Apache Software Foundation CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

mozilla3,666 CVEs siemens3,608 CVEs openSUSE3,314 CVEs Qualcomm3,033 CVEs HP2,526 CVEs Netapp2,519 CVEs Huawei2,383 CVEs Tenda2,048 CVEs

Browse all vendors

Frequently asked questions

Common questions about Apache Software Foundation vulnerabilities.

How many CVEs does Apache Software Foundation have?: Apache Software Foundation has 3,182 published CVE records since 1999, including 660 in the last two years.
How many Apache Software Foundation CVEs are in CISA KEV?: Yes — 44 of Apache Software Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Apache Software Foundation products have the most CVEs?: The Apache Software Foundation products with the most published CVEs are http_server, Tomcat, Airflow, Apache Airflow, Apache HTTP Server.
What are the most common weakness types in Apache Software Foundation CVEs?: Apache Software Foundation's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-502 (Deserialization of Untrusted Data), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Are there public exploits for Apache Software Foundation vulnerabilities?: Yes — 448 of Apache Software Foundation's CVEs have a known public exploit.
How many critical Apache Software Foundation vulnerabilities are there?: Apache Software Foundation has 610 critical and 1,129 high-severity CVEs.
What is the average severity of Apache Software Foundation CVEs?: The average CVSS base score across Apache Software Foundation's scored CVEs is 7.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation vulnerabilities

Monitor new Apache Software Foundation vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing