428
CVEs
94
Critical
187
High
2
KEV
12
PoC
90
Unpatched C/H
68.7%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
94
HIGH
187
MEDIUM
137
LOW
10
Monthly CVE Trend
Affected Products (30)
Apache Traffic Server
40
Apache Airflow
35
Apache Camel
29
Apache Cloudstack
27
Tomcat
27
Apache Tomcat
27
Java
24
Apache Http Server
23
Apache Ofbiz
17
Apache Apisix
15
Apache Cxf
15
Apache Syncope
13
Apache Iotdb
13
Apache Activemq
12
Apache Ranger
10
Apache Inlong
9
Apache Activemq All
8
Apache Answer
7
Apache Activemq Broker
7
Apache Opennlp
7
Kubernetes
6
Apache Fory
6
Apache Nimble
6
Apache Neethi
6
Apache Portable Runtime Utility
5
Apache Allura
5
Apache Lucy
4
Apache Mina
4
Apache Camel K
4
LDAP
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-34197 | Remote code execution in Apache ActiveMQ Classic versions before 5.19.5 and 6.0.0-6.2.2 allows authenticated attackers to execute arbitrary code on the broker's JVM via Jolokia MBean operations. Attackers with low-privilege web console access can invoke BrokerService.addNetworkConnector() with a malicious discovery URI containing a VM transport brokerConfig parameter that loads remote Spring XML contexts, triggering bean instantiation and code execution through factory methods like Runtime.exec( | HIGH | 8.8 | 0.1% | 129 |
KEV
PoC
|
| CVE-2026-34486 | Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive session data to network-positioned attackers because the EncryptInterceptor - the clustering security control - can be bypassed due to a regression introduced by the fix for CVE-2026-29146. Listed in CISA KEV as actively exploited with a publicly available exploit, though EPSS sits at just 0.01% (1st percentile), indicating targeted rather than widespread automated exploitation. The confidentiality impact is rated High with no integrity or availability impact, consistent with CWE-311 (Missing Encryption of Sensitive Data). | HIGH | 7.5 | 0.0% | 108 |
KEV
PoC
|
| CVE-2026-33453 | Remote code execution in Apache Camel's camel-coap component (versions 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0) allows an unauthenticated attacker to inject arbitrary internal Camel headers via CoAP URI query parameters, achieving OS command execution when a route forwards to a header-sensitive producer such as camel-exec. The component maps incoming CoAP query parameters straight into Exchange message headers with no HeaderFilterStrategy, so a single UDP packet to port 5683 can override the executable and arguments of a downstream exec producer and return command output in the CoAP response. Rated CVSS 10.0 with publicly available exploit code, though EPSS remains modest (0.55%, 68th percentile) and CISA SSVC records no observed exploitation, indicating opportunity rather than confirmed mass exploitation. | CRITICAL | 10.0 | 0.5% | 71 |
PoC
|
| CVE-2026-40858 | Unsafe Java deserialization in Apache Camel's camel-infinispan component allows arbitrary code execution when the ProtoStream-based remote aggregation repository reads objects from an Infinispan cache using java.io.ObjectInputStream with no ObjectInputFilter applied. Any attacker able to write to the backing Infinispan cache can plant a malicious serialized gadget that executes in the application context during routine get/recover operations. Publicly available exploit code exists, though EPSS is low (0.08%) and there is no evidence of active exploitation. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-23918 | Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation allows authenticated attackers to compromise server integrity and confidentiality with high impact. Vendor-released patch 2.4.67 addresses the issue. No public exploit or active exploitation confirmed at time of analysis, but SSVC framework rates technical impact as total, indicating complete system compromise potential. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-40466 | Remote code execution in Apache ActiveMQ 5.x (before 5.19.6) and 6.x (before 6.2.5) allows authenticated attackers to bypass prior security fixes (CVE-2026-34197) by injecting malicious Spring XML configurations through HTTP Discovery transport connectors via Jolokia. Attackers leverage a VM transport loophole to invoke arbitrary bean factory methods like Runtime.exec() during Spring context initialization. EPSS score is low (0.06%, 19th percentile) with no confirmed active exploitation (not in CISA KEV), suggesting limited widespread targeting despite high CVSS 8.8 score. Exploitation requires authenticated Jolokia access and presence of activemq-http module on classpath. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-34059 | Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network scale. Attackers can read sensitive memory content without authentication or user interaction, achieving high confidentiality impact with low attack complexity. EPSS exploitation probability and KEV status not provided, but SSVC framework confirms the vulnerability is automatable with partial technical impact and no active exploitation detected at time of analysis. Patch released in version 2.4.67. | HIGH | 7.5 | 0.1% | 58 |
PoC
|
| CVE-2026-29146 | Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7.0.100-7.0.109, 8.5.38-8.5.100, 9.0.13-9.0.115, 10.0.0-M1-10.1.52, and 11.0.0-M1-11.0.18 when default configuration is deployed. Unauthenticated remote attackers exploit oracle responses to decrypt sensitive information without authentication (CVSS:3.1 AV:N/AC:L/PR:N). CWE-209 (information exposure through error messages) enables cryptographic side-channel extraction. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%). | HIGH | 7.5 | 0.0% | 58 |
PoC
|
| CVE-2026-50229 | Reflected XSS in Apache Tomcat's bundled 'number guess' example application exposes users of that demo page to script injection across all major Tomcat release lines from 7.0 through 11.0. The flaw resides in a sample JSP/servlet, not the core Tomcat runtime, meaning exploitation depends entirely on the example application being deployed and accessible - a configuration that violates standard production hardening guidance. No public exploit code or active exploitation has been identified at time of analysis; no CVSS vector was assigned by the reporter. | MEDIUM | 6.1 | 0.2% | 51 |
PoC
|
| CVE-2026-82617 | Denial of service in Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 lets a remote unauthenticated attacker pin CPU or crash a worker thread by feeding crafted text to either of the two built-in RegexNameFinder patterns (EMAIL and URL) obtained via RegexNameFinderFactory.getDefaultRegexNameFinders(). The EMAIL pattern's ambiguous nested quantifiers cause quadratic catastrophic backtracking (~32 KB of local-part characters burns seconds of CPU per find() call), while the URL pattern's nested capturing repetition recurses once per query token, exhausting the thread stack and throwing StackOverflowError (~4 KB, or ~1 KB on -Xss512k worker threads). No public exploit was identified at time of analysis; this is availability-only with no code execution or data exposure. | CRITICAL | 10.0 | 0.3% | 50 |
|
| CVE-2026-33264 | Remote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controlled class path is loaded via an unrestricted import_string() when the Scheduler or API Server deserializes the serialized DAG, executing arbitrary code in those privileged processes and breaking the core Airflow boundary that DAG-author code must never run in the Scheduler/API Server. Reported by Apache with a fix in 3.3.0, it currently has no public exploit identified and a low EPSS of 0.69% (48th percentile), and it is not listed in CISA KEV. The practical severity depends heavily on how much a deployment trusts its DAG authors, since exploitation requires the ability to submit a DAG. | CRITICAL | 9.8 | 0.7% | 50 |
|
| CVE-2026-44416 | Remote code execution in Apache Ranger 2.8.0 and earlier arises from arbitrary Java class instantiation in the plugin-schema-registry component, letting an attacker who can reach the affected interface load and run attacker-controlled classes and achieve full compromise (CWE-94). The flaw carries a critical CVSS 9.8 and is fixed in Ranger 2.9.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with EPSS at a modest 0.58% (45th percentile). | CRITICAL | 9.8 | 0.6% | 50 |
No patch
|
| CVE-2026-64606 | Remote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises because attacker-supplied data can bypass the class-registration allowlist during Java lambda deserialization, with the gap confined to the lambda capture class. Registration checks are Fory's core defense against untrusted-deserialization gadget attacks, so bypassing them for lambda payloads can let an attacker instantiate otherwise-disallowed classes and reach code execution or memory corruption. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; the vendor (Apache) rates it CVSS 9.8 and a fixed release (1.4.0) is available. | CRITICAL | 9.8 | 0.5% | 50 |
|
| CVE-2026-42537 | Remote code execution in Apache Ranger versions up to and including 2.8.0 arises from JDBC URL injection (CWE-94), letting an attacker who can influence a database connection string coerce the server into loading attacker-controlled JDBC driver behavior and executing arbitrary code on the Ranger host. This flaw affects the centralized authorization framework used to govern access across Hadoop-ecosystem services, so compromise undermines the very control plane meant to enforce data security. There is no public exploit identified at time of analysis and EPSS is low (0.36%, 29th percentile), but the fix in 2.9.0 and the critical 9.8 CVSS warrant prompt patching. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-49845 | SQL injection in the Apache Hive Metastore (versions 4.0.0 through 4.2.0) lets a caller who can invoke partition-name Metastore RPCs manipulate the generated WHERE clause so operations intended for one partition match additional rows in the same table. Because client-supplied partition names are concatenated into direct-SQL statements instead of bound as parameters, a crafted name containing a single quote can redirect reads, statistics updates, truncate/drop targets, and file-metadata cache operations to unintended partitions. No public exploit is identified at time of analysis and the flaw is not in CISA KEV; the input assigns CVSS 9.8, but the vendor description constrains impact to partition targeting within referenceable tables rather than arbitrary cross-database access. | CRITICAL | 9.8 | 0.3% | 49 |
|