263
CVEs
65
Critical
119
High
0
KEV
2
PoC
82
Unpatched C/H
54.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
65
HIGH
119
MEDIUM
72
LOW
7
Monthly CVE Trend
Affected Products (30)
Apache Traffic Server
40
Apache Airflow
35
Apache Camel
29
Apache Cloudstack
27
Tomcat
27
Apache Tomcat
27
Java
24
Apache Http Server
23
Apache Ofbiz
17
Apache Apisix
15
Apache Cxf
15
Apache Syncope
13
Apache Iotdb
13
Apache Activemq
12
Apache Ranger
10
Apache Inlong
9
Apache Activemq All
8
Apache Answer
7
Apache Activemq Broker
7
Apache Opennlp
7
Kubernetes
6
Apache Fory
6
Apache Nimble
6
Apache Neethi
6
Apache Portable Runtime Utility
5
Apache Allura
5
Apache Lucy
4
Apache Mina
4
Apache Camel K
4
LDAP
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-50229 | Reflected XSS in Apache Tomcat's bundled 'number guess' example application exposes users of that demo page to script injection across all major Tomcat release lines from 7.0 through 11.0. The flaw resides in a sample JSP/servlet, not the core Tomcat runtime, meaning exploitation depends entirely on the example application being deployed and accessible - a configuration that violates standard production hardening guidance. No public exploit code or active exploitation has been identified at time of analysis; no CVSS vector was assigned by the reporter. | MEDIUM | 6.1 | 0.2% | 51 |
PoC
|
| CVE-2026-82617 | Denial of service in Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 lets a remote unauthenticated attacker pin CPU or crash a worker thread by feeding crafted text to either of the two built-in RegexNameFinder patterns (EMAIL and URL) obtained via RegexNameFinderFactory.getDefaultRegexNameFinders(). The EMAIL pattern's ambiguous nested quantifiers cause quadratic catastrophic backtracking (~32 KB of local-part characters burns seconds of CPU per find() call), while the URL pattern's nested capturing repetition recurses once per query token, exhausting the thread stack and throwing StackOverflowError (~4 KB, or ~1 KB on -Xss512k worker threads). No public exploit was identified at time of analysis; this is availability-only with no code execution or data exposure. | CRITICAL | 10.0 | 0.3% | 50 |
|
| CVE-2026-33264 | Remote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controlled class path is loaded via an unrestricted import_string() when the Scheduler or API Server deserializes the serialized DAG, executing arbitrary code in those privileged processes and breaking the core Airflow boundary that DAG-author code must never run in the Scheduler/API Server. Reported by Apache with a fix in 3.3.0, it currently has no public exploit identified and a low EPSS of 0.69% (48th percentile), and it is not listed in CISA KEV. The practical severity depends heavily on how much a deployment trusts its DAG authors, since exploitation requires the ability to submit a DAG. | CRITICAL | 9.8 | 0.7% | 50 |
|
| CVE-2026-44416 | Remote code execution in Apache Ranger 2.8.0 and earlier arises from arbitrary Java class instantiation in the plugin-schema-registry component, letting an attacker who can reach the affected interface load and run attacker-controlled classes and achieve full compromise (CWE-94). The flaw carries a critical CVSS 9.8 and is fixed in Ranger 2.9.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with EPSS at a modest 0.58% (45th percentile). | CRITICAL | 9.8 | 0.6% | 50 |
No patch
|
| CVE-2026-64606 | Remote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises because attacker-supplied data can bypass the class-registration allowlist during Java lambda deserialization, with the gap confined to the lambda capture class. Registration checks are Fory's core defense against untrusted-deserialization gadget attacks, so bypassing them for lambda payloads can let an attacker instantiate otherwise-disallowed classes and reach code execution or memory corruption. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; the vendor (Apache) rates it CVSS 9.8 and a fixed release (1.4.0) is available. | CRITICAL | 9.8 | 0.5% | 50 |
|
| CVE-2026-42537 | Remote code execution in Apache Ranger versions up to and including 2.8.0 arises from JDBC URL injection (CWE-94), letting an attacker who can influence a database connection string coerce the server into loading attacker-controlled JDBC driver behavior and executing arbitrary code on the Ranger host. This flaw affects the centralized authorization framework used to govern access across Hadoop-ecosystem services, so compromise undermines the very control plane meant to enforce data security. There is no public exploit identified at time of analysis and EPSS is low (0.36%, 29th percentile), but the fix in 2.9.0 and the critical 9.8 CVSS warrant prompt patching. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-49845 | SQL injection in the Apache Hive Metastore (versions 4.0.0 through 4.2.0) lets a caller who can invoke partition-name Metastore RPCs manipulate the generated WHERE clause so operations intended for one partition match additional rows in the same table. Because client-supplied partition names are concatenated into direct-SQL statements instead of bound as parameters, a crafted name containing a single quote can redirect reads, statistics updates, truncate/drop targets, and file-metadata cache operations to unintended partitions. No public exploit is identified at time of analysis and the flaw is not in CISA KEV; the input assigns CVSS 9.8, but the vendor description constrains impact to partition targeting within referenceable tables rather than arbitrary cross-database access. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-40008 | Unsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and instantiated via Class.forName().newInstance() with no allowlisting, enabling arbitrary class loading and likely remote code execution in the database server process. It affects all releases from 1.0.0 up to (but not including) 2.0.10 and is fixed in 2.0.10. No public exploit identified at time of analysis, and EPSS is low (0.25%, 17th percentile), though CISA SSVC rates the technical impact as total and considers exploitation automatable. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-71300 | Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket message dispatch in routes that bridge an HTTP consumer into the producer. Because the dispatch headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType) use dotted names outside the filtered Camel namespace, the inherited HttpHeaderFilterStrategy admits them in both directions, so an attacker-supplied header overrides the recipient the route selected - suppressing a notification meant for one client or redirecting it to another client whose connection key the sender knows. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and it is not in CISA KEV, though the vendor rates it CVSS 9.8. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-57308 | SQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through stacked queries by abusing unsanitized sort parameters, affecting the 3.0.x, 4.0.x, and 4.1.x branches up to 3.0.16, 4.0.6, and 4.1.1 respectively. Because stacked queries are supported, an attacker can go beyond data theft to modify or destroy identity data and potentially chain to further backend compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the NVD CVSS 9.8 (PR:N) contradicts the vendor description, which explicitly requires an authenticated privileged administrator. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-71558 | Heap type confusion in the Apache Fory C++ deserialization engine (versions 0.14.0 up to but not including 1.5.0) lets a crafted payload bypass type-compatibility checks during polymorphic smart-pointer deserialization, so an object of an incompatible type is handled as its declared base type. Because CWE-502 untrusted-data handling here corrupts memory rather than merely mis-parsing values, an attacker who controls serialized input can trigger undefined behavior ranging from denial of service to arbitrary code execution. This is rated CVSS 9.8 and is fixed in 1.5.0; there is no public exploit identified at time of analysis and EPSS is low at 0.21%. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-63038 | SQL injection in Apache InLong versions 2.0.0 through 2.3.x allows remote attackers to inject arbitrary SQL via the dbName, tableName, schemaName, and username parameters, compromising the integrity and confidentiality of the backend database. The flaw carries a CVSS 9.8 (network, no authentication, no user interaction) and was disclosed by the Apache project itself; a vendor patch exists in 2.4.0. There is no public exploit identified at time of analysis, and EPSS estimates exploitation probability at a low 0.21% (11th percentile). | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-40920 | Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissions by manipulating a URL parameter, undermining the very access-control layer Ranger is meant to enforce across Hadoop-ecosystem services. Apache rates it CVSS 9.8 with a network, low-complexity, no-privilege vector, though the 'privilege escalation' framing implies a pre-existing foothold that is worth verifying. There is no public exploit identified at time of analysis, and the EPSS score is low (0.19%, 9th percentile), indicating no observed mass-exploitation activity yet. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-28564 | Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials against the REST interface because Basic Authentication continues to accept cached credentials that should have been invalidated. An attacker who has captured or previously held valid credentials can keep authenticating after those credentials should have expired or been revoked, gaining full read/write control of the time-series database. No public exploit identified at time of analysis, and EPSS is low (0.18%, 8th percentile), so no active exploitation is indicated despite the 9.8 CVSS. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-73240 | Remote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-controlled arguments into git command invocations through specially crafted inputs. Because Allura is a project-hosting and forge platform that shells out to git, this argument injection (CWE-88) can be leveraged to influence git behavior and, depending on the invoked subcommand, achieve command execution against the hosting server; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.18%). | CRITICAL | 9.8 | 0.2% | 49 |
|