# Apache vulnerabilities

Source: https://junglewise.ai/threats/vendors/apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/apache.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 1,263 vulnerabilities in Apache: 90 in the last 7 days and 743 in the last 90 days, 174 of them critical and 43 exploited in the wild. The most recent, CVE-2026-16659, was published on 13 November 2026. 324 vulnerabilities in the last four weeks, up 26% on the four before (258). 9 critical against 28. 77 technologies have a page of their own.

## Counts

- Last 7 days: 90
- Last 30 days: 401
- Last 90 days: 743
- All time: 1263 (174 critical, 43 exploited in the wild)

## About Apache

Apache Software Foundation develops open-source software projects including web servers, middleware, and other applications.

## Latest Apache vulnerabilities

- [CVE-2026-16659: MCUboot serial-recovery NULL pointer dereference in encryption handler](https://junglewise.ai/threats/cve-2026-16659-mcuboot-s-serial-recovery-image-upload-handler-bs-upload-in-boot) (medium, CVSS 4, published 13 Nov 2026)
- [CVE-2026-124023: Apache Axis2/C out-of-bounds read in Guththila XML parser](https://junglewise.ai/threats/cve-2026-124023-out-of-bounds-read-vulnerability-in-the-guththila-xml-parser) (info, published 12 Nov 2026)
- [CVE-2026-123765: Apache Sling XSS cross-site scripting in getStyleToken](https://junglewise.ai/threats/cve-2026-123765-improper-neutralization-of-input-during-web-page-generation) (info, published 12 Nov 2026)
- [CVE-2026-89326: Apache XML Graphics Batik origin validation bypass](https://junglewise.ai/threats/cve-2026-89326-origin-validation-error-vulnerability-in-apache-xml-graphics) (info, published 11 Nov 2026)
- [CVE-2026-71395: Apache XML Graphics FOP unsafe deserialization in hyphenation loading](https://junglewise.ai/threats/cve-2026-71395-unsafe-deserialization-in-hyphenation-loading-vulnerability-in) (info, published 11 Nov 2026)
- [CVE-2026-44929: Apache XML Graphics Batik SSRF vulnerability](https://junglewise.ai/threats/cve-2026-44929-server-side-request-forgery-ssrf-vulnerability-in-apache-xml) (info, published 11 Nov 2026)
- [CVE-2026-119618: Apache HTTP Server mod_http2 heap corruption in assign_headers](https://junglewise.ai/threats/cve-2026-119618-concurrent-execution-using-shared-resource-with-improper) (info, published 11 Nov 2026)
- [CVE-2026-109163: Apache HTTP Server mod_vhost_alias stack buffer overflow](https://junglewise.ai/threats/cve-2026-109163-stack-based-buffer-overflow-vulnerability-in-apache-http-server) (info, published 11 Nov 2026)
- [CVE-2026-106023: Apache HTTP Server mod_md NULL pointer dereference](https://junglewise.ai/threats/cve-2026-106023-null-pointer-dereference-vulnerability-in-apache-http-server-s) (info, published 11 Nov 2026)
- [CVE-2026-49236: Apache XML Graphics Batik SSRF in SVG color-profile xml:base](https://junglewise.ai/threats/cve-2026-49236-server-side-request-forgery-ssrf-vulnerability-in-apache-xml) (info, published 11 Nov 2026)
- [CVE-2026-40853: Apache Batik SVG font metadata cross-site scripting](https://junglewise.ai/threats/cve-2026-40853-a-cross-site-scripting-via-unencoded-font-metadata-in-apache) (info, published 11 Nov 2026)
- [CVE-2026-94125: Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on) (info, published 11 Nov 2026)
- [CVE-2026-124495: Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves) (info, published 11 Nov 2026)
- [CVE-2026-123374: Apache Roller XML-RPC deserialization remote code execution](https://junglewise.ai/threats/cve-2026-123374-deserialization-of-untrusted-data-vulnerability-in-apache-roller) (info, published 11 Nov 2026)
- [CVE-2026-122300: Apache Roller missing authorization in entry editor](https://junglewise.ai/threats/cve-2026-122300-missing-authorization-vulnerability-in-apache-roller-4-0-through) (info, published 11 Nov 2026)
- [CVE-2026-122096: Apache DataSketches Java uncontrolled resource consumption in sketch deserialization](https://junglewise.ai/threats/cve-2026-122096-uncontrolled-resource-consumption-vulnerability-in-the-sketch) (info, published 11 Nov 2026)
- [CVE-2026-118414: Apache Roller stored cross-site scripting in weblog menu](https://junglewise.ai/threats/cve-2026-118414-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 5.4, published 11 Nov 2026)
- [CVE-2026-118413: Apache Roller stored cross-site scripting in blogroll import](https://junglewise.ai/threats/cve-2026-118413-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 5.4, published 11 Nov 2026)
- [CVE-2026-118411: Apache Roller CSRF allowing unauthenticated administrator account creation](https://junglewise.ai/threats/cve-2026-118411-cross-site-request-forgery-csrf-in-apache-roller-5-0-1-through-6) (high, CVSS 8.8, published 11 Nov 2026)
- [CVE-2026-118409: Apache Roller information disclosure via search index](https://junglewise.ai/threats/cve-2026-118409-exposure-of-sensitive-information-to-an-unauthorized-actor-in) (medium, CVSS 5.3, published 11 Nov 2026)
- [CVE-2026-118405: Apache Roller information disclosure in user search](https://junglewise.ai/threats/cve-2026-118405-exposure-of-sensitive-information-to-an-unauthorized-actor-in) (medium, CVSS 4.3, published 11 Nov 2026)
- [CVE-2026-111824: Apache Roller stored cross-site scripting in custom theme media](https://junglewise.ai/threats/cve-2026-111824-improper-neutralization-of-input-during-web-page-generation) (info, published 11 Nov 2026)
- [CVE-2026-108338: Apache Roller stored cross-site scripting in entry tags](https://junglewise.ai/threats/cve-2026-108338-improper-neutralization-of-input-during-web-page-generation) (info, published 11 Nov 2026)
- [CVE-2026-105154: Apache Roller cross-site request forgery in Planet feed administration](https://junglewise.ai/threats/cve-2026-105154-cross-site-request-forgery-csrf-in-the-planet-feed-aggregator) (medium, CVSS 6.1, published 11 Nov 2026)
- [CVE-2026-105153: Apache Roller XML external entity injection in AtomPub](https://junglewise.ai/threats/cve-2026-105153-improper-restriction-of-xml-external-entity-reference-in-apache) (high, CVSS 7.7, published 11 Nov 2026)

## Most severe Apache vulnerabilities

- [CVE-2012-0391: Apache Struts Remote Java Code Execution](https://junglewise.ai/threats/cve-2012-0391-apache-struts-2-improper-input-validation-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 4 May 2022)
- [CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability](https://junglewise.ai/threats/cve-2024-45195-apache-ofbiz-forced-browsing-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 4 Feb 2025)
- [CVE-2024-38856: Apache OFBiz Incorrect Authorization Vulnerability](https://junglewise.ai/threats/cve-2024-38856-apache-ofbiz-incorrect-authorization-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 27 Aug 2024)
- [CVE-2024-32113: Apache OFBiz Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-32113-apache-ofbiz-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 7 Aug 2024)
- [CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerability](https://junglewise.ai/threats/cve-2022-24706-apache-couchdb-insecure-default-initialization-of-resource) (critical, exploited in the wild, CVSS 9.8, published 25 Aug 2022)
- [CVE-2022-24112: Apache APISIX Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2022-24112-apache-apisix-authentication-bypass-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Aug 2022)
- [CVE-2021-41773: Apache HTTP Server Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2021-41773-apache-http-server-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021)
- [CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2021-42013-apache-http-server-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021)
- [CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability](https://junglewise.ai/threats/cve-2024-38475-apache-http-server-improper-escaping-of-output-vulnerability) (critical, exploited in the wild, CVSS 9.1, published 1 May 2025)
- [CVE-2021-45046: Incomplete fix for Apache Log4j vulnerability](https://junglewise.ai/threats/cve-2021-45046-apache-log4j2-deserialization-of-untrusted-data-vulnerability) (critical, exploited in the wild, CVSS 9, published 14 Dec 2021)

## Vulnerabilities per week

324 vulnerabilities in the last four weeks, up 26% on the four before (258). 9 critical against 28.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 31 | 6 | 0 |
| 24 Aug 2026 | 24 | 7 | 0 |
| 31 Aug 2026 | 8 | 1 | 0 |
| 7 Sep 2026 | 16 | 7 | 0 |
| 14 Sep 2026 | 32 | 8 | 0 |
| 21 Sep 2026 | 44 | 8 | 0 |
| 28 Sep 2026 | 151 | 10 | 0 |
| 5 Oct 2026 | 31 | 2 | 0 |
| 12 Oct 2026 | 21 | 1 | 0 |
| 19 Oct 2026 | 155 | 7 | 0 |
| 26 Oct 2026 | 53 | 1 | 0 |
| 2 Nov 2026 | 95 | 0 | 0 |
| 9 Nov 2026 | 82 | 0 | 0 |

## Apache technologies

- [Apache Airflow](https://junglewise.ai/threats/technologies/airflow): 95 vulnerabilities
- [Apache Camel](https://junglewise.ai/threats/technologies/camel): 87 vulnerabilities
- [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat): 87 vulnerabilities
- [Apache Thrift](https://junglewise.ai/threats/technologies/thrift): 77 vulnerabilities
- [Apache Ofbiz](https://junglewise.ai/threats/technologies/ofbiz): 67 vulnerabilities
- [Apache HTTP Server](https://junglewise.ai/threats/technologies/http-server): 62 vulnerabilities
- [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server): 55 vulnerabilities
- [Apache Brpc](https://junglewise.ai/threats/technologies/brpc): 36 vulnerabilities
- [Apache Roller](https://junglewise.ai/threats/technologies/roller): 30 vulnerabilities
- [Apache CloudStack](https://junglewise.ai/threats/technologies/cloudstack): 28 vulnerabilities
- [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 27 vulnerabilities
- [Apache Apisix](https://junglewise.ai/threats/technologies/apisix): 27 vulnerabilities
- [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket): 23 vulnerabilities
- [Apache Kylin](https://junglewise.ai/threats/technologies/kylin): 23 vulnerabilities
- [Apache Storm](https://junglewise.ai/threats/technologies/storm): 22 vulnerabilities
- [Apache OpenOffice](https://junglewise.ai/threats/technologies/openoffice): 20 vulnerabilities
- [Apache ActiveMQ Artemis](https://junglewise.ai/threats/technologies/activemq-artemis): 16 vulnerabilities
- [Apache DolphinScheduler](https://junglewise.ai/threats/technologies/apache-dolphinscheduler-1): 16 vulnerabilities
- [Apache Allura](https://junglewise.ai/threats/technologies/allura): 14 vulnerabilities
- [Apache Pulsar](https://junglewise.ai/threats/technologies/pulsar): 14 vulnerabilities
- [Apache Struts](https://junglewise.ai/threats/technologies/struts): 14 vulnerabilities
- [Apache Answer](https://junglewise.ai/threats/technologies/apache-answer): 13 vulnerabilities
- [Apache Kafka](https://junglewise.ai/threats/technologies/kafka): 13 vulnerabilities
- [Apache ActiveMQ Broker](https://junglewise.ai/threats/technologies/activemq-broker): 12 vulnerabilities
- [Apache Ranger](https://junglewise.ai/threats/technologies/ranger): 12 vulnerabilities
- [Apache Zookeeper](https://junglewise.ai/threats/technologies/zookeeper): 12 vulnerabilities
- [Apache CXF](https://junglewise.ai/threats/technologies/apache-cxf): 10 vulnerabilities
- [Apache Artemis](https://junglewise.ai/threats/technologies/artemis): 10 vulnerabilities
- [Apache Inlong](https://junglewise.ai/threats/technologies/inlong): 10 vulnerabilities
- [Apache OpenEJB](https://junglewise.ai/threats/technologies/openejb): 10 vulnerabilities
- [Apache Superset](https://junglewise.ai/threats/technologies/superset): 10 vulnerabilities
- [Apache Juneau](https://junglewise.ai/threats/technologies/juneau): 9 vulnerabilities
- [Apache MINA SSHD](https://junglewise.ai/threats/technologies/mina-sshd): 9 vulnerabilities
- [Apache Neethi](https://junglewise.ai/threats/technologies/apache-neethi): 8 vulnerabilities
- [Apache Syncope](https://junglewise.ai/threats/technologies/apache-syncope): 8 vulnerabilities
- [Apache Shiro](https://junglewise.ai/threats/technologies/shiro): 8 vulnerabilities
- [Apache WSS4J](https://junglewise.ai/threats/technologies/apache-wss4j): 7 vulnerabilities
- [Apache CouchDB](https://junglewise.ai/threats/technologies/couchdb): 7 vulnerabilities
- [Apache Directory Ldap Api](https://junglewise.ai/threats/technologies/directory-ldap-api): 7 vulnerabilities
- [Apache Log4net](https://junglewise.ai/threats/technologies/log4net): 7 vulnerabilities
- [Apache Mina](https://junglewise.ai/threats/technologies/mina): 7 vulnerabilities
- [Apache Tomcat-Embed-Core](https://junglewise.ai/threats/technologies/tomcat-embed-core): 7 vulnerabilities
- [Apache Karaf](https://junglewise.ai/threats/technologies/karaf): 6 vulnerabilities
- [Apache Qpid Broker-J](https://junglewise.ai/threats/technologies/qpid-broker-j): 6 vulnerabilities
- [Apache Sling XSS](https://junglewise.ai/threats/technologies/sling-xss): 6 vulnerabilities
- [Apache Spark](https://junglewise.ai/threats/technologies/spark): 6 vulnerabilities
- [Apache XML Graphics Batik](https://junglewise.ai/threats/technologies/xml-graphics-batik): 6 vulnerabilities
- [Apache-Airflow-Providers-Fab](https://junglewise.ai/threats/technologies/apache-airflow-providers-fab): 5 vulnerabilities
- [Apache Fineract](https://junglewise.ai/threats/technologies/apache-fineract): 5 vulnerabilities
- [Apache IoTDB](https://junglewise.ai/threats/technologies/apache-iotdb-1): 5 vulnerabilities
- [Apache Tomcat Native](https://junglewise.ai/threats/technologies/apache-tomcat-native): 5 vulnerabilities
- [Apache DataSketches C++](https://junglewise.ai/threats/technologies/datasketches-c): 5 vulnerabilities
- [Apache James](https://junglewise.ai/threats/technologies/james): 5 vulnerabilities
- [Apache Opennlp](https://junglewise.ai/threats/technologies/opennlp): 5 vulnerabilities
- [Apache Polaris](https://junglewise.ai/threats/technologies/polaris): 5 vulnerabilities
- [Apache Struts 2](https://junglewise.ai/threats/technologies/struts-2): 5 vulnerabilities
- [Apache Axis2/Java](https://junglewise.ai/threats/technologies/apache-axis2-java): 4 vulnerabilities
- [Apache Cocoon](https://junglewise.ai/threats/technologies/apache-cocoon): 4 vulnerabilities
- [Apache Qpid Proton C](https://junglewise.ai/threats/technologies/qpid-proton-c): 4 vulnerabilities
- [Apache Solr](https://junglewise.ai/threats/technologies/solr): 4 vulnerabilities
- [Apache Streampark](https://junglewise.ai/threats/technologies/streampark): 4 vulnerabilities
- [Apache Cassandra](https://junglewise.ai/threats/technologies/apache-cassandra): 3 vulnerabilities
- [Apache Impala](https://junglewise.ai/threats/technologies/apache-impala): 3 vulnerabilities
- [Apache Openmeetings](https://junglewise.ai/threats/technologies/apache-openmeetings): 3 vulnerabilities
- [Apache Axis2\](https://junglewise.ai/threats/technologies/axis2): 3 vulnerabilities
- [Apache Camel JMS](https://junglewise.ai/threats/technologies/camel-jms): 3 vulnerabilities
- [Apache Camel SJMS](https://junglewise.ai/threats/technologies/camel-sjms): 3 vulnerabilities
- [Apache Fory](https://junglewise.ai/threats/technologies/fory): 3 vulnerabilities
- [Apache Geronimo](https://junglewise.ai/threats/technologies/geronimo): 3 vulnerabilities
- [Apache Jakarta Security](https://junglewise.ai/threats/technologies/jakarta-security): 3 vulnerabilities
- [Apache Log4j](https://junglewise.ai/threats/technologies/log4j): 3 vulnerabilities
- [Apache Log4j2](https://junglewise.ai/threats/technologies/log4j2): 3 vulnerabilities
- [Apache Nutch](https://junglewise.ai/threats/technologies/nutch): 3 vulnerabilities
- [Apache PLC4X](https://junglewise.ai/threats/technologies/plc4x): 3 vulnerabilities
- [Apache Sling Engine](https://junglewise.ai/threats/technologies/sling-engine): 3 vulnerabilities
- [Apache Tomcat Coyote](https://junglewise.ai/threats/technologies/tomcat-coyote): 3 vulnerabilities
- [Apache TomEE](https://junglewise.ai/threats/technologies/tomee): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Apache vulnerabilities", https://junglewise.ai/threats/vendors/apache, 13 November 2026.