AS
Vendor security profile4 actively exploited CVEs
Apache Software Foundation
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs609
Critical116
CISA KEV4
Public exploit11
Patch rate%20
Avg. CVSS7.5
12-month vulnerability rate
0
0
1
2
2
13
4
18
44
168
187
141
CVE KEV
CVE severity distribution
609toplam CVE
Critical116 (19%)
High289 (47%)
Medium179 (29%)
Low10 (2%)
Uncertain15 (2%)
Patch and exploitation view
%20
Verified patch
%1
CISA KEV
%2
Public exploit
124Patch available
0Partial
2Workaround
0Vendor: no patch
483Unknown
Latest vulnerabilities
-
CVE-2026-103636
Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103635
Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103513
Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103501
Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch
AS
Patch status unknownEPSS %0
8.8
CVE-2026-103413
Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
AS
Patch verifiedEPSS %0
8.8
CVE-2026-103412
Apache Camel Karavan: project file name path traversal when committing a project to Git
AS
Patch verifiedEPSS %1
-
CVE-2026-108039
Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
AS
Patch status unknownEPSS %0
-
CVE-2026-107938
Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
AS
Patch status unknownEPSS %0
-
CVE-2026-107937
Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
AS
Patch status unknownEPSS %0
-
CVE-2026-100227
Apache CXF: XML Signature wrapping in JAX-RS XML Security
AS
Patch status unknownEPSS %0