Vendor
Apache vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 1,263 vulnerabilities in Apache: 90 in the last 7 days and 743 in the last 90 days, 174 of them critical and 43 exploited in the wild. The most recent, CVE-2026-16659, was published on 13 November 2026. 324 vulnerabilities in the last four weeks, up 26% on the four before (258). 9 critical against 28. 77 technologies have a page of their own.
- Last 7 days
- 90
- Last 90 days
- 743
- Critical, all time
- 174
- Exploited in the wild
- 43
About Apache
Apache Software Foundation develops open-source software projects including web servers, middleware, and other applications.
Apache technologies
- Apache Airflow95
- Apache Camel87
- Apache Tomcat87
- Apache Thrift77
- Apache Ofbiz67
- Apache HTTP Server62
- Apache Traffic Server55
- Apache Brpc36
- Apache Roller30
- Apache CloudStack28
- Apache ActiveMQ27
- Apache Apisix27
- Apache Wicket23
- Apache Kylin23
- Apache Storm22
- Apache OpenOffice20
- Apache ActiveMQ Artemis16
- Apache DolphinScheduler16
- Apache Allura14
- Apache Pulsar14
- Apache Struts14
- Apache Answer13
- Apache Kafka13
- Apache ActiveMQ Broker12
- Apache Ranger12
- Apache Zookeeper12
- Apache CXF10
- Apache Artemis10
- Apache Inlong10
- Apache OpenEJB10
- Apache Superset10
- Apache Juneau9
- Apache MINA SSHD9
- Apache Neethi8
- Apache Syncope8
- Apache Shiro8
- Apache WSS4J7
- Apache CouchDB7
- Apache Directory Ldap Api7
- Apache Log4net7
- Apache Mina7
- Apache Tomcat-Embed-Core7
- Apache Karaf6
- Apache Qpid Broker-J6
- Apache Sling XSS6
- Apache Spark6
- Apache XML Graphics Batik6
- Apache-Airflow-Providers-Fab5
- Apache Fineract5
- Apache IoTDB5
- Apache Tomcat Native5
- Apache DataSketches C++5
- Apache James5
- Apache Opennlp5
- Apache Polaris5
- Apache Struts 25
- Apache Axis2/Java4
- Apache Cocoon4
- Apache Qpid Proton C4
- Apache Solr4
- Apache Streampark4
- Apache Cassandra3
- Apache Impala3
- Apache Openmeetings3
- Apache Axis2\3
- Apache Camel JMS3
- Apache Camel SJMS3
- Apache Fory3
- Apache Geronimo3
- Apache Jakarta Security3
- Apache Log4j3
- Apache Log4j23
- Apache Nutch3
- Apache PLC4X3
- Apache Sling Engine3
- Apache Tomcat Coyote3
- Apache TomEE3
Latest Apache vulnerabilities
- CVE-2026-16659: MCUboot serial-recovery NULL pointer dereference in encryption handlermediumCVSS 4
- CVE-2026-124023: Apache Axis2/C out-of-bounds read in Guththila XML parserinfo
- CVE-2026-123765: Apache Sling XSS cross-site scripting in getStyleTokeninfo
- CVE-2026-89326: Apache XML Graphics Batik origin validation bypassinfo
- CVE-2026-71395: Apache XML Graphics FOP unsafe deserialization in hyphenation loadinginfo
- CVE-2026-44929: Apache XML Graphics Batik SSRF vulnerabilityinfo
- CVE-2026-119618: Apache HTTP Server mod_http2 heap corruption in assign_headersinfo
- CVE-2026-109163: Apache HTTP Server mod_vhost_alias stack buffer overflowinfo
- CVE-2026-106023: Apache HTTP Server mod_md NULL pointer dereferenceinfo
- CVE-2026-49236: Apache XML Graphics Batik SSRF in SVG color-profile xml:baseinfo
- CVE-2026-40853: Apache Batik SVG font metadata cross-site scriptinginfo
- CVE-2026-94125: Apache Storm Nimbus information disclosure in worker placementinfo
- CVE-2026-124495: Apache Storm Logviewer symlink traversal in worker logsinfo
- CVE-2026-123374: Apache Roller XML-RPC deserialization remote code executioninfo
- CVE-2026-122300: Apache Roller missing authorization in entry editorinfo
- CVE-2026-122096: Apache DataSketches Java uncontrolled resource consumption in sketch deserializationinfo
- CVE-2026-118414: Apache Roller stored cross-site scripting in weblog menumediumCVSS 5.4
- CVE-2026-118413: Apache Roller stored cross-site scripting in blogroll importmediumCVSS 5.4
- CVE-2026-118411: Apache Roller CSRF allowing unauthenticated administrator account creationhighCVSS 8.8
- CVE-2026-118409: Apache Roller information disclosure via search indexmediumCVSS 5.3
- CVE-2026-118405: Apache Roller information disclosure in user searchmediumCVSS 4.3
- CVE-2026-111824: Apache Roller stored cross-site scripting in custom theme mediainfo
- CVE-2026-108338: Apache Roller stored cross-site scripting in entry tagsinfo
- CVE-2026-105154: Apache Roller cross-site request forgery in Planet feed administrationmediumCVSS 6.1
- CVE-2026-105153: Apache Roller XML external entity injection in AtomPubhighCVSS 7.7
Most severe Apache vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2012-0391: Apache Struts Remote Java Code Executioncriticalexploited in the wildCVSS 9.8EPSS 75.6%
- CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2024-38856: Apache OFBiz Incorrect Authorization Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2024-32113: Apache OFBiz Path Traversal Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2022-24112: Apache APISIX Authentication Bypass Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2021-41773: Apache HTTP Server Path Traversal Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerabilitycriticalexploited in the wildCVSS 9.1
- CVE-2021-45046: Incomplete fix for Apache Log4j vulnerabilitycriticalexploited in the wildCVSS 9EPSS 100.0%
Vulnerabilities per week
324 vulnerabilities in the last four weeks, up 26% on the four before (258). 9 critical against 28. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 31 | 6 | |
| 24 Aug 2026 | 24 | 7 | |
| 31 Aug 2026 | 8 | 1 | |
| 7 Sep 2026 | 16 | 7 | |
| 14 Sep 2026 | 32 | 8 | |
| 21 Sep 2026 | 44 | 8 | |
| 28 Sep 2026 | 151 | 10 | |
| 5 Oct 2026 | 31 | 2 | |
| 12 Oct 2026 | 21 | 1 | |
| 19 Oct 2026 | 155 | 7 | |
| 26 Oct 2026 | 53 | 1 | |
| 2 Nov 2026 | 95 | 0 | |
| 9 Nov 2026 | 82 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apache vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/apache)<a href="https://junglewise.ai/threats/vendors/apache"><img src="https://junglewise.ai/threats/vendors/apache/badge.svg" alt="Apache vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/apache.json, and this page as text at https://junglewise.ai/threats/vendors/apache.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apache vulnerabilities", https://junglewise.ai/threats/vendors/apache, 13 November 2026.