CVE Tools
Track your stack

Apache

3,083 CVEs across 261 months on the top 200 list since Sep 2003. Peak rank #3 in Jan 2012. 39 of them are now in CISA KEV.

Apache CVEs per month since Sep 2003

Oct 2021 to Sep 2026 in the lens. Point at a month to read it, or drag the frame to move through the record.Tallest in the lens: 163, Aug 2026
Oct 2021: 15 CVEs · 4 critical · 2 now in CISA KEV · rank #37 · mostly Openoffice, HTTP Server, StormNov 2021: 24 CVEs · 7 critical · 0 now in CISA KEV · rank #26 · mostly Ozone, Traffic Server, SupersetDec 2021: 14 CVEs · 5 critical · 2 now in CISA KEV · rank #40 · mostly LOG4J, HTTP Server, Sling Commons Messaging MailJan 2022: 32 CVEs · 7 critical · 0 now in CISA KEV · rank #29 · mostly Kylin, James, ShenyuFeb 2022: 14 CVEs · 3 critical · 1 now in CISA KEV · rank #50 · mostly Jspwiki, Gobblin, AirflowMar 2022: 12 CVEs · 5 critical · 0 now in CISA KEV · rank #52 · mostly HTTP Server, Traffic Server, CloudstackApr 2022: 11 CVEs · 4 critical · 1 now in CISA KEV · rank #63 · mostly Subversion, Nifi, SupersetMay 2022: 9 CVEs · 2 critical · 0 now in CISA KEV · rank #69 · mostly Tika, Tomcat, Maven Shared UtilsJun 2022: 18 CVEs · 5 critical · 0 now in CISA KEV · rank #38 · mostly HTTP Server, Hadoop, Sling Commons LogJul 2022: 13 CVEs · 3 critical · 1 now in CISA KEV · rank #52 · mostly Druid, Spark, Apache Calcite AvaticaAug 2022: 26 CVEs · 3 critical · 0 now in CISA KEV · rank #30 · mostly Traffic Server, Jspwiki, GeodeSep 2022: 26 CVEs · 5 critical · 0 now in CISA KEV · rank #32 · mostly Ofbiz, Pulsar, AirflowOct 2022: 17 CVEs · 6 critical · 0 now in CISA KEV · rank #49 · mostly Isis, Batik, Commons JxpathNov 2022: 27 CVEs · 8 critical · 0 now in CISA KEV · rank #29 · mostly Airflow, Dolphinscheduler, ArchivaDec 2022: 18 CVEs · 6 critical · 0 now in CISA KEV · rank #43 · mostly Traffic Server, Zeppelin, CxfJan 2023: 25 CVEs · 6 critical · 0 now in CISA KEV · rank #35 · mostly Superset, HTTP Server, IotdbFeb 2023: 16 CVEs · 5 critical · 0 now in CISA KEV · rank #48 · mostly Inlong, Apache-airflow-providers-google, Sling Jcr BaseMar 2023: not on the top 200 that monthApr 2023: 21 CVEs · 8 critical · 1 now in CISA KEV · rank #40 · mostly Linkis, Superset, Apache-airflow-providers-apache-sparkMay 2023: 31 CVEs · 10 critical · 1 now in CISA KEV · rank #22 · mostly Inlong, Streampark, OpenmeetingsJun 2023: 16 CVEs · 1 critical · 0 now in CISA KEV · rank #41 · mostly Traffic Server, Apache-airflow-providers-odbc, StrutsJul 2023: 29 CVEs · 8 critical · 0 now in CISA KEV · rank #30 · mostly Airflow, Pulsar, InlongAug 2023: 16 CVEs · 1 critical · 0 now in CISA KEV · rank #52 · mostly Airflow, Xml Graphics Batik, Traffic ServerSep 2023: 17 CVEs · 1 critical · 0 now in CISA KEV · rank #45 · mostly Superset, Airflow, Tomcat ConnectorsOct 2023: 25 CVEs · 3 critical · 2 now in CISA KEV · rank #32 · mostly Airflow, Tomcat, InlongNov 2023: 26 CVEs · 6 critical · 0 now in CISA KEV · rank #25 · mostly Superset, Dolphinscheduler, CocoonDec 2023: 28 CVEs · 6 critical · 0 now in CISA KEV · rank #30 · mostly Airflow, Hertzbeat, OfbizJan 2024: 15 CVEs · 3 critical · 0 now in CISA KEV · rank #59 · mostly Airflow, Servicecomb, InlongFeb 2024: 41 CVEs · 11 critical · 0 now in CISA KEV · rank #21 · mostly Superset, Dolphinscheduler, SolrMar 2024: 28 CVEs · 5 critical · 0 now in CISA KEV · rank #33 · mostly Pulsar, Archiva, FineractApr 2024: 27 CVEs · 5 critical · 1 now in CISA KEV · rank #36 · mostly Zeppelin, HTTP Server, CloudstackMay 2024: 8 CVEs · 3 critical · 1 now in CISA KEV · rank #143 · mostly Superset, Airflow, ActivemqJun 2024: 10 CVEs · 4 critical · 0 now in CISA KEV · rank #67 · mostly Submarine, Allura, SupersetJul 2024: 46 CVEs · 9 critical · 1 now in CISA KEV · rank #23 · mostly HTTP Server, Streampark, StreampipesAug 2024: 20 CVEs · 4 critical · 1 now in CISA KEV · rank #41 · mostly Dolphinscheduler, Linkis, HertzbeatSep 2024: 14 CVEs · 2 critical · 1 now in CISA KEV · rank #47 · mostly Ofbiz, Airflow, DruidOct 2024: 15 CVEs · 1 critical · 0 now in CISA KEV · rank #44 · mostly Cloudstack, Solr, SyncopeNov 2024: 26 CVEs · 6 critical · 0 now in CISA KEV · rank #38 · mostly Tomcat, Traffic Server, NimbleDec 2024: 17 CVEs · 7 critical · 0 now in CISA KEV · rank #38 · mostly Superset, Tomcat, HiveJan 2025: 16 CVEs · 2 critical · 0 now in CISA KEV · rank #45 · mostly Ambari, Solr, RangerFeb 2025: 13 CVEs · 2 critical · 0 now in CISA KEV · rank #59 · mostly Cassandra, James Server, KvrocksMar 2025: 23 CVEs · 3 critical · 1 now in CISA KEV · rank #40 · mostly Traffic Server, Vcl, CamelApr 2025: 19 CVEs · 4 critical · 0 now in CISA KEV · rank #45 · mostly Tomcat, Activemq Artemis, HTTP ServerMay 2025: 15 CVEs · 4 critical · 0 now in CISA KEV · rank #55 · mostly Inlong, Iotdb, SupersetJun 2025: 21 CVEs · 5 critical · 0 now in CISA KEV · rank #37 · mostly Cloudstack, Kafka, TomcatJul 2025: 24 CVEs · 1 critical · 0 now in CISA KEV · rank #48 · mostly HTTP Server, Tomcat, JspwikiAug 2025: 20 CVEs · 3 critical · 0 now in CISA KEV · rank #50 · mostly Superset, Zeppelin, TomcatSep 2025: 10 CVEs · 1 critical · 0 now in CISA KEV · rank #67 · mostly Dolphinscheduler, Iotdb, HertzbeatOct 2025: 20 CVEs · 3 critical · 0 now in CISA KEV · rank #49 · mostly Tomcat, Airflow, KylinNov 2025: 19 CVEs · 1 critical · 0 now in CISA KEV · rank #35 · mostly Openoffice, Cloudstack, KvrocksDec 2025: 20 CVEs · 3 critical · 0 now in CISA KEV · rank #40 · mostly HTTP Server, Fineract, StreamparkJan 2026: 22 CVEs · 3 critical · 0 now in CISA KEV · rank #34 · mostly Nimble, Nuttx, SolrFeb 2026: 20 CVEs · 2 critical · 0 now in CISA KEV · rank #54 · mostly Airflow, Superset, SyncopeMar 2026: 20 CVEs · 4 critical · 0 now in CISA KEV · rank #56 · mostly Airflow, Ranger, Activemq ArtemisApr 2026: 84 CVEs · 11 critical · 1 now in CISA KEV · rank #11 · mostly Airflow, Tomcat, CamelMay 2026: 80 CVEs · 18 critical · 0 now in CISA KEV · rank #10 · mostly Ofbiz, HTTP Server, CloudstackJun 2026: 110 CVEs · 19 critical · 0 now in CISA KEV · rank #8 · mostly Airflow, Activemq, HTTP ServerJul 2026: 116 CVEs · 31 critical · 0 now in CISA KEV · rank #9 · mostly Camel, Thrift, Traffic ServerAug 2026: 163 CVEs · 39 critical · 0 now in CISA KEV · rank #8 · mostly Cloudstack, Airflow, CxfSep 2026 so far: 38 CVEs · 15 critical · 0 now in CISA KEV · rank #25 · mostly Artemis, Zookeeper, Apache-airflow-providers-fab

In the lens

The products that kept showing up in Apache's monthly top three from Oct 2021 to Sep 2026. Move the lens and the list follows.

  1. Airflow9817 months
  2. HTTP Server7312 months
  3. Superset5113 months
  4. Camel453 months
  5. Cloudstack427 months
  6. Traffic Server429 months
  7. Tomcat3610 months
  8. Ofbiz274 months
  9. Inlong256 months
  10. Activemq162 months

Year by year

Each year's months on the top 200 list. Pick a year to read it in the lens.

The record

Peak rank
#3 in Jan 2012
Busiest month
Aug 2026, 163 CVEs
Months with a KEV entry
33 of 240 on the list
On the top 200 list
240 of 277 monthly snapshots

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store