13 CVEs
2 in CISA KEV
org.apache.logging.log4j Vulnerabilities
CVE security advisories and vulnerability history for org.apache.logging.log4j.
13
Total CVEs
Published
2
In CISA KEV
Exploited in the wild
2
Public exploits
With known exploit
6.9
Avg CVSS
2017–2026
Overview
org.apache.logging.log4j has 13 published CVE records since 2017, of which 2 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 6.9.
This page aggregates every publicly disclosed vulnerability (CVE) affecting org.apache.logging.log4j products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.