Vendor

Apache Software Foundation vulnerabilities

Updated 9 November 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 204 vulnerabilities in Apache Software Foundation: 0 in the last 7 days and 8 in the last 90 days, 27 of them critical and 1 exploited in the wild. The most recent, CVE-2026-73637, was published on 1 October 2026. Nothing in the last four weeks, down from 8 vulnerabilities in the four before. 0 critical against 1. 22 technologies have a page of their own.

Last 7 days: 0
Last 90 days: 8
Critical, all time: 27
Exploited in the wild: 1

About Apache Software Foundation

Non-profit open source software foundation that develops and maintains projects like Apache HTTP Server, Kafka, and Hadoop.

Apache Software Foundation technologies

Latest Apache Software Foundation vulnerabilities

CVE-2026-73637: Apache HTTP Server mod_auth_digest use-after-freehighCVSS 7.3EPSS 0.3%1 Oct 2026
CVE-2026-73636: Apache HTTP Server authentication bypass in mod_auth_digesthighCVSS 8.1EPSS 0.4%1 Oct 2026
CVE-2026-63686: Apache HTTP Server NULL pointer dereference in mod_xml2enchighCVSS 7.5EPSS 0.3%1 Oct 2026
CVE-2026-63292: Apache HTTP Server stack buffer overflow in mod_vhost_aliashighCVSS 7.5EPSS 0.6%1 Oct 2026
CVE-2026-63045: Apache HTTP Server FTP PASV reply validation bypass in mod_proxy_ftphighCVSS 7.5EPSS 0.3%1 Oct 2026
CVE-2026-59797: Apache HTTP Server mod_ssl privilege escalation in SSLRequire expressionscriticalCVSS 9.8EPSS 0.4%1 Oct 2026
CVE-2026-58415: Apache HTTP Server mod_dav_fs information disclosure in WebDAV propertiesmediumCVSS 5.3EPSS 0.3%1 Oct 2026
CVE-2026-48005: Apache HTTP Server mod_auth_digest reauthentication attackhighCVSS 7.5EPSS 0.6%1 Oct 2026
CVE-2026-64607: Apache HttpComponents Client resource leak in classic I/O modelmediumCVSS 5.3EPSS 0.6%31 Jul 2026
CVE-2026-62391: Apache Kyuubi path traversal via Spark config alias bypassinfoCVSS 031 Jul 2026
CVE-2026-44615: Apache Zeppelin path traversal in FileSystemNotebookRepoinfoCVSS 031 Jul 2026
CVE-2026-66756: Apache Tika path protection bypass in tika-server unpack endpointinfoCVSS 6.930 Jul 2026
CVE-2026-66755: Apache Tika path traversal in ISA-Tab parserinfoCVSS 5.930 Jul 2026
CVE-2026-52680: Apache Kyuubi path traversal in REST batch multipart uploadinfoCVSS 030 Jul 2026
CVE-2026-48910: Apache JSPWiki XSS in markdown renderer error processingmediumCVSS 6.530 Jul 2026
CVE-2026-44617: Apache Zeppelin LDAP filter injection in LdapRealminfoCVSS 030 Jul 2026
CVE-2026-44616: Apache Zeppelin LDAP injection in ActiveDirectoryGroupRealminfoCVSS 030 Jul 2026
CVE-2026-44613: Apache Zeppelin CSRF in REST and WebSocket endpointsinfoCVSS 030 Jul 2026
CVE-2026-28814: Apache JSPWiki unauthenticated wiki markup renderinginfoCVSS 030 Jul 2026
CVE-2026-28813: Apache JSPWiki JSON hijacking leading to CSRFinfoCVSS 030 Jul 2026
CVE-2026-28812: Apache JSPWiki privilege escalation in UserManagerinfoCVSS 030 Jul 2026
CVE-2026-28811: Apache JSPWiki information disclosure in debug messagesinfoCVSS 3.730 Jul 2026
CVE-2026-59243: Apache Airflow FAB provider authentication bypass in Azure AD OAuthinfoCVSS 8.129 Jul 2026
CVE-2026-23904: Apache Kyuubi SSRF in Engine UI proxyinfo29 Jul 2026
CVE-2026-66713: Apache Axis2/Java remote code execution in Tribes clustering componentinfoCVSS 9.828 Jul 2026

Most severe Apache Software Foundation vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2026-34486: Apache Tomcat encryption bypass in EncryptInterceptorcriticalexploited in the wildCVSS 7.5EPSS 6.6%9 Apr 2026
CVE-2019-0219: Apache cordova-plugin-inappbrowser privilege escalation on AndroidcriticalCVSS 9.8EPSS 7.8%4 Sep 2020
CVE-2023-25693: Apache Airflow Sqoop Provider improper input validationcriticalCVSS 9.8EPSS 1.9%24 Feb 2023
CVE-2026-47323: Apache Camel header injection in CXF and Knative componentscriticalCVSS 9.8EPSS 1.6%19 May 2026
CVE-2022-46337: Apache Derby LDAP injection in authenticatorcriticalCVSS 9.8EPSS 1.4%20 Nov 2023
CVE-2026-50633: Apache CXF JNDI injection in JCA integration modulecriticalCVSS 9.8EPSS 1.3%12 Jun 2026
CVE-2026-53913: Apache Camel Keycloak authentication bypass in KeycloakSecurityPolicycriticalCVSS 9.8EPSS 1.1%6 Jul 2026
CVE-2026-50628: Apache CXF inverted IP binding check in OAuthRequestFiltercriticalCVSS 9.8EPSS 1.0%12 Jun 2026
CVE-2025-67895: Apache Airflow Providers Edge3 RCE in web server contextcriticalCVSS 9.8EPSS 1.0%17 Dec 2025
CVE-2026-48207: Apache Fory PyFory deserialization bypass in ReduceSerializercriticalCVSS 9.8EPSS 0.8%21 May 2026

Vulnerabilities per week

Nothing in the last four weeks, down from 8 vulnerabilities in the four before. 0 critical against 1. The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Vulns	Critical
17 Aug 2026	0	0
24 Aug 2026	0	0
31 Aug 2026	0	0
7 Sep 2026	0	0
14 Sep 2026	0	0
21 Sep 2026	0	0
28 Sep 2026	8	1
5 Oct 2026	0	0
12 Oct 2026	0	0
19 Oct 2026	0	0
26 Oct 2026	0	0
2 Nov 2026	0	0
9 Nov 2026	0	0

Embed a badge

A live badge for a README, a status page or an internal wiki: how many Apache Software Foundation vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.

[![Apache Software Foundation vulnerabilities](https://junglewise.ai/threats/vendors/apache-software-foundation/badge.svg)](https://junglewise.ai/threats/vendors/apache-software-foundation)

<a href="https://junglewise.ai/threats/vendors/apache-software-foundation"><img src="https://junglewise.ai/threats/vendors/apache-software-foundation/badge.svg" alt="Apache Software Foundation vulnerabilities" /></a>

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/vendors/apache-software-foundation.json, and this page as text at https://junglewise.ai/threats/vendors/apache-software-foundation.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "Apache Software Foundation vulnerabilities", https://junglewise.ai/threats/vendors/apache-software-foundation, 9 November 2026.