A
Vendor security profile42 actively exploited CVEs
apache
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs780
Critical157
CISA KEV42
Public exploit84
Patch rate%27
Avg. CVSS7.4
12-month vulnerability rate
2
12
7
3
6
33
30
86
172
165
88
30
CVE KEV
CVE severity distribution
780toplam CVE
Critical157 (20%)
High337 (43%)
Medium261 (33%)
Low10 (1%)
Uncertain15 (2%)
Patch and exploitation view
%27
Verified patch
%5
CISA KEV
%11
Public exploit
206Patch available
7Partial
27Workaround
1Vendor: no patch
539Unknown
Latest vulnerabilities
-
CVE-2026-103636
Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103635
Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103513
Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103501
Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch
AS
Patch status unknownEPSS %0
8.8
CVE-2026-103413
Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
AS
Patch verifiedEPSS %0
8.8
CVE-2026-103412
Apache Camel Karavan: project file name path traversal when committing a project to Git
AS
Patch verifiedEPSS %1
-
CVE-2026-108039
Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
AS
Patch status unknownEPSS %0
-
CVE-2026-107938
Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
AS
Patch status unknownEPSS %0
-
CVE-2026-107937
Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
AS
Patch status unknownEPSS %0
-
CVE-2026-100227
Apache CXF: XML Signature wrapping in JAX-RS XML Security
AS
Patch status unknownEPSS %0