935
CVEs
191
Critical
404
High
3
KEV
54
PoC
194
Unpatched C/H
67.7%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
191
HIGH
404
MEDIUM
312
LOW
26
Monthly CVE Trend
Affected Products (30)
Java
295
Debian Linux
268
Tomcat
206
Fedora
137
Http Server
120
Airflow
104
Ubuntu Linux
101
Struts
72
Traffic Server
62
Superset
60
Opensuse
57
PHP
55
Retail Xstore Point Of Service
52
Camel
51
Activemq
51
Enterprise Linux Server
50
Enterprise Linux Workstation
49
Enterprise Linux Desktop
49
Cxf
49
Nifi
47
Ofbiz
47
Instantis Enterprisetrack
44
Apache Traffic Server
40
Communications Session Route Manager
39
Enterprise Linux Server Aus
39
Jboss Enterprise Application Platform
38
Solr
38
Openoffice
37
Python
37
Communications Session Report Manager
36
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-34197 | Remote code execution in Apache ActiveMQ Classic versions before 5.19.5 and 6.0.0-6.2.2 allows authenticated attackers to execute arbitrary code on the broker's JVM via Jolokia MBean operations. Attackers with low-privilege web console access can invoke BrokerService.addNetworkConnector() with a malicious discovery URI containing a VM transport brokerConfig parameter that loads remote Spring XML contexts, triggering bean instantiation and code execution through factory methods like Runtime.exec( | HIGH | 8.8 | 0.1% | 129 |
KEV
PoC
|
| CVE-2016-15057 | Command injection in Apache Continuum (unsupported). EPSS 37.9% indicates active exploitation of this legacy CI/CD system. No patch available — product is end-of-life. | CRITICAL | 9.9 | 37.9% | 122 |
PoC
No patch
|
| CVE-2026-21962 | Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthenticated network attackers to fully compromise the middleware layer. | CRITICAL | 10.0 | 0.0% | 120 |
KEV
PoC
|
| CVE-2026-34486 | Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive session data to network-positioned attackers because the EncryptInterceptor - the clustering security control - can be bypassed due to a regression introduced by the fix for CVE-2026-29146. Listed in CISA KEV as actively exploited with a publicly available exploit, though EPSS sits at just 0.01% (1st percentile), indicating targeted rather than widespread automated exploitation. The confidentiality impact is rated High with no integrity or availability impact, consistent with CWE-311 (Missing Encryption of Sensitive Data). | HIGH | 7.5 | 0.0% | 108 |
KEV
PoC
|
| CVE-2026-27636 | Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that bypass file upload restrictions, enabling arbitrary code execution on Apache servers with `AllowOverride All` enabled. Public exploit code exists for this vulnerability. The attack requires valid user credentials but affects all FreeScout installations using the vulnerable PHP Laravel framework configuration. | HIGH | 8.8 | 0.3% | 79 |
PoC
|
| CVE-2026-33453 | Remote code execution in Apache Camel's camel-coap component (versions 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0) allows an unauthenticated attacker to inject arbitrary internal Camel headers via CoAP URI query parameters, achieving OS command execution when a route forwards to a header-sensitive producer such as camel-exec. The component maps incoming CoAP query parameters straight into Exchange message headers with no HeaderFilterStrategy, so a single UDP packet to port 5683 can override the executable and arguments of a downstream exec producer and return command output in the CoAP response. Rated CVSS 10.0 with publicly available exploit code, though EPSS remains modest (0.55%, 68th percentile) and CISA SSVC records no observed exploitation, indicating opportunity rather than confirmed mass exploitation. | CRITICAL | 10.0 | 0.5% | 71 |
PoC
|
| CVE-2026-73649 | Remote code execution in Velocity.js (npm 'velocityjs') versions <= 2.1.6 lets an attacker who controls template content reach the JavaScript Function constructor and run arbitrary code in the server process. The earlier CVE-2026-44966/GHSA-j658-c2gf-x6pq fix only filtered constructor/__proto__/prototype in the #set assignment target, leaving property-read expressions in references.ts unguarded, so this is a straightforward bypass. Publicly available exploit code exists (a working PoC is published in the GHSA advisory and was vendor-verified on v2.1.6); no confirmed active exploitation (not in CISA KEV). | CRITICAL | 9.8 | 0.5% | 70 |
PoC
|
| CVE-2026-44825 | Full administrative cluster takeover in Apache Solr 9.4.0-9.10.1 and 10.0.0 arises because the 'bin/solr auth enable' setup tool silently provisions hardcoded template accounts (superadmin, admin, search, index) with publicly known default passwords alongside the operator's chosen account. Any remote attacker who reaches the Solr endpoint can authenticate with these baked-in credentials and obtain total control of the cluster. There is no public exploit identified at time of analysis and EPSS is low (0.21%), but the CVSS 9.8 rating and 'total' SSVC technical impact make this a high-severity misconfiguration-by-default flaw. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2026-33439 | Remote code execution in OpenIdentityPlatform OpenAM 16.0.5 and earlier allows unauthenticated attackers to execute arbitrary OS commands via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypass exploits an unpatched deserialization sink in JATO's ClientSession.deserializeAttributes() that was overlooked when CVE-2021-35464 was mitigated. Attackers can target any JATO ViewBean endpoint with <jato:form> tags (commonly found in password reset pages) using a PriorityQue | CRITICAL | 9.3 | 0.1% | 67 |
PoC
|
| CVE-2016-20026 | Critical hardcoded credentials vulnerability in ZKTeco ZKBioSecurity 3.0's bundled Apache Tomcat server that allows unauthenticated remote attackers to upload malicious WAR files and execute arbitrary code with SYSTEM privileges. Multiple public exploits are available (Exploit-DB, Packet Storm), making this a high-risk vulnerability for organizations using this biometric security management software. | CRITICAL | 9.3 | 0.1% | 67 |
PoC
No patch
|
| CVE-2026-39920 | Remote code execution in BridgeHead FileStore pre-24A via Apache Axis2 default credentials allows unauthenticated attackers to deploy malicious web services and execute arbitrary OS commands. The vulnerability exploits exposed Axis2 admin console with unchanged default credentials, enabling full system compromise over the network with no authentication required. Publicly available exploit code exists (GitHub Gist), and CVSS 9.8 reflects critical risk with network vector, low complexity, and no privileges required. EPSS data not provided but exploitation prerequisites are minimal given default credential exposure. | CRITICAL | 9.3 | 0.2% | 66 |
PoC
|
| CVE-2026-23552 | Cross-realm token acceptance bypass in Apache Camel Keycloak security policy. The KeycloakSecurityPolicy fails to properly validate token issuers, accepting tokens from different Keycloak realms. PoC available. | CRITICAL | 9.1 | 0.0% | 66 |
PoC
|
| CVE-2026-67608 | OS command injection in Telenia Software TVox allows authenticated high-privilege attackers to execute arbitrary operating system commands via the unsanitized `pid` parameter in `action_audio.php`. Affected deployments span TVox 26.x through 26.5.3 and 24.x through 24.9.21, running on an Apache/PHP stack where successful exploitation yields command execution as the `apache` system user. A publicly available proof-of-concept exploit exists (KarmaInSecurity KIS-2026-15, confirmed by VulnCheck), though no CISA KEV listing is present, indicating active exploitation is not yet confirmed at scale. | HIGH | 8.6 | 1.5% | 65 |
PoC
No patch
|
| CVE-2026-23697 | Remote code execution in Vtiger CRM before 8.4.0 lets an authenticated low-privileged user upload a malicious .phar file through the Documents module and execute arbitrary PHP. The extension denylist in config.inc.php omits .phar, and a stale Apache 2.2-syntax .htaccess is silently ignored on Apache 2.4, so the payload lands in a web-accessible directory reachable by unauthenticated HTTP - the attack begins authenticated but the final execution step is unauthenticated. Publicly available exploit code exists (published by VulnCheck/Jiva Security); no CISA KEV listing and no EPSS score were provided. | HIGH | 8.7 | 0.8% | 64 |
PoC
No patch
|
| CVE-2026-25747 | Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.1% | 64 |
PoC
|