Apache-software-foundation
2,485 CVEs across 140 months on the top 200 list since Mar 2006. Peak rank #5 in Jul 2026. 37 of them are now in CISA KEV.
Apache-software-foundation CVEs per month since Mar 2006
Oct 2021: 17 CVEs · 4 critical · 2 now in CISA KEV · rank #34 · mostly Apache Openoffice, Apache HTTP Server, OpenofficeNov 2021: 25 CVEs · 7 critical · 0 now in CISA KEV · rank #25 · mostly Apache Ozone, Apache Traffic Server, Traffic ServerDec 2021: 17 CVEs · 6 critical · 3 now in CISA KEV · rank #37 · mostly LOG4J, HTTP Server, Apache LOG4J2Jan 2022: 32 CVEs · 7 critical · 0 now in CISA KEV · rank #30 · mostly Apache Kylin, Apache Shenyu (Incubating), Apache JamesFeb 2022: 14 CVEs · 3 critical · 1 now in CISA KEV · rank #51 · mostly Apache Airflow, Apache Gobblin, Apache JspwikiMar 2022: 12 CVEs · 5 critical · 0 now in CISA KEV · rank #53 · mostly HTTP Server, Apache HTTP Server, Apache Traffic ServerApr 2022: 13 CVEs · 4 critical · 1 now in CISA KEV · rank #58 · mostly LOG4J, Apache Nifi, SubversionMay 2022: 10 CVEs · 2 critical · 0 now in CISA KEV · rank #66 · mostly Apache Tika, Tomcat, Apache TomcatJun 2022: 18 CVEs · 5 critical · 0 now in CISA KEV · rank #39 · mostly Apache HTTP Server, HTTP Server, Apache HadoopJul 2022: 13 CVEs · 3 critical · 1 now in CISA KEV · rank #53 · mostly Apache Druid, Apache Cloudstack, Apache Commons ConfigurationAug 2022: 26 CVEs · 3 critical · 0 now in CISA KEV · rank #31 · mostly Apache Traffic Server, Apache Jspwiki, Apache AvroSep 2022: 30 CVEs · 5 critical · 0 now in CISA KEV · rank #29 · mostly Apache Ofbiz, Apache Airflow, Apache PulsarOct 2022: 20 CVEs · 7 critical · 0 now in CISA KEV · rank #46 · mostly Commons Jxpath, Batik, CassandraNov 2022: 28 CVEs · 8 critical · 0 now in CISA KEV · rank #26 · mostly Apache Airflow, Apache Dolphinscheduler, IvyDec 2022: 21 CVEs · 6 critical · 0 now in CISA KEV · rank #37 · mostly Apache Traffic Server, Apache Cxf, Apache ZeppelinJan 2023: 25 CVEs · 5 critical · 0 now in CISA KEV · rank #36 · mostly Apache Superset, HTTP Server, Apache HTTP ServerFeb 2023: 16 CVEs · 5 critical · 0 now in CISA KEV · rank #49 · mostly Apache Airflow Google Provider, Apache Inlong, Apache Airflow Hive ProviderMar 2023: not on the top 200 that monthApr 2023: 21 CVEs · 8 critical · 1 now in CISA KEV · rank #41 · mostly Apache Linkis, Apache Superset, Apache Airflow Drill ProviderMay 2023: 31 CVEs · 10 critical · 1 now in CISA KEV · rank #23 · mostly Apache Inlong, Inlong, Apache Streampark (Incubating)Jun 2023: 18 CVEs · 1 critical · 0 now in CISA KEV · rank #40 · mostly Traffic Server, Apache Traffic Server, Apache Airflow Odbc ProviderJul 2023: 29 CVEs · 8 critical · 0 now in CISA KEV · rank #31 · mostly Airflow, Apache Airflow, Apache InlongAug 2023: 17 CVEs · 1 critical · 0 now in CISA KEV · rank #47 · mostly Airflow, Apache Airflow, Apache Airflow Spark ProviderSep 2023: 17 CVEs · 1 critical · 0 now in CISA KEV · rank #46 · mostly Apache Superset, Superset, AirflowOct 2023: 26 CVEs · 3 critical · 2 now in CISA KEV · rank #31 · mostly Airflow, Apache Airflow, Apache InlongNov 2023: 28 CVEs · 6 critical · 0 now in CISA KEV · rank #24 · mostly Apache Superset, Apache Dolphinscheduler, AirflowDec 2023: 24 CVEs · 6 critical · 0 now in CISA KEV · rank #36 · mostly Apache Airflow, Airflow, Apache OfbizJan 2024: 15 CVEs · 3 critical · 0 now in CISA KEV · rank #60 · mostly Apache Airflow, Apache Inlong, Apache Servicecomb Service-centerFeb 2024: 38 CVEs · 8 critical · 0 now in CISA KEV · rank #22 · mostly Apache Superset, Apache Dolphinscheduler, Apache SolrMar 2024: 29 CVEs · 5 critical · 0 now in CISA KEV · rank #32 · mostly Pulsar, Apache Pulsar, Apache DorisApr 2024: 27 CVEs · 5 critical · 1 now in CISA KEV · rank #37 · mostly Apache Zeppelin, Apache HTTP Server, Apache CloudstackMay 2024: 8 CVEs · 3 critical · 1 now in CISA KEV · rank #144 · mostly Apache Apisix, Activemq, Apache ActivemqJun 2024: 12 CVEs · 4 critical · 0 now in CISA KEV · rank #52 · mostly Directory Ldap API, Apache Submarine Server Core, Apache AlluraJul 2024: 46 CVEs · 9 critical · 1 now in CISA KEV · rank #24 · mostly Apache HTTP Server, HTTP Server, Apache StreamparkAug 2024: 18 CVEs · 4 critical · 1 now in CISA KEV · rank #46 · mostly Apache Dolphinscheduler, Apache Cloudstack, Apache AnswerSep 2024: 14 CVEs · 2 critical · 1 now in CISA KEV · rank #48 · mostly Apache Ofbiz, Apache Druid, OfbizOct 2024: 15 CVEs · 1 critical · 0 now in CISA KEV · rank #45 · mostly Apache Cloudstack, Apache Solr, Apache Avro Java SdkNov 2024: 25 CVEs · 6 critical · 0 now in CISA KEV · rank #39 · mostly Apache Tomcat, Apache Nimble, TomcatDec 2024: 17 CVEs · 7 critical · 0 now in CISA KEV · rank #39 · mostly Superset, Apache Superset, Apache TomcatJan 2025: 16 CVEs · 2 critical · 0 now in CISA KEV · rank #46 · mostly Apache Ambari, Apache Hive, HiveFeb 2025: 15 CVEs · 2 critical · 0 now in CISA KEV · rank #51 · mostly Cassandra, Apache Cassandra, Apache James ServerMar 2025: 23 CVEs · 3 critical · 1 now in CISA KEV · rank #41 · mostly Apache Traffic Server, Traffic Server, Commons Vfs (Virtual File System)Apr 2025: 19 CVEs · 4 critical · 0 now in CISA KEV · rank #46 · mostly Apache Tomcat, Apache Activemq Artemis, PinotMay 2025: 15 CVEs · 4 critical · 0 now in CISA KEV · rank #56 · mostly Inlong, Apache Inlong, Apache IotdbJun 2025: 21 CVEs · 5 critical · 0 now in CISA KEV · rank #38 · mostly Apache Cloudstack, Tomcat, KafkaJul 2025: 24 CVEs · 1 critical · 0 now in CISA KEV · rank #49 · mostly HTTP Server, Apache HTTP Server, TomcatAug 2025: 21 CVEs · 3 critical · 0 now in CISA KEV · rank #48 · mostly Apache Superset, Superset, Apache ZeppelinSep 2025: 12 CVEs · 1 critical · 0 now in CISA KEV · rank #63 · mostly Netty, Apache Iotdb, Apache Hertzbeat (Incubating)Oct 2025: 20 CVEs · 3 critical · 0 now in CISA KEV · rank #50 · mostly Apache Kylin, Tomcat, Apache AirflowNov 2025: 19 CVEs · 1 critical · 0 now in CISA KEV · rank #36 · mostly Apache Openoffice, Openoffice, Apache OfbizDec 2025: 22 CVEs · 4 critical · 0 now in CISA KEV · rank #35 · mostly Apache HTTP Server, HTTP Server, Apache FineractJan 2026: 22 CVEs · 3 critical · 0 now in CISA KEV · rank #35 · mostly Apache Mynewt Nimble, Apache Airflow, Apache SolrFeb 2026: 25 CVEs · 2 critical · 0 now in CISA KEV · rank #42 · mostly Apache Airflow, Apache Superset, TomcatMar 2026: 20 CVEs · 4 critical · 0 now in CISA KEV · rank #57 · mostly Apache Airflow, Airflow, Apache RangerApr 2026: 86 CVEs · 11 critical · 1 now in CISA KEV · rank #10 · mostly Apache Airflow, Apache Tomcat, Apache ThriftMay 2026: 87 CVEs · 19 critical · 0 now in CISA KEV · rank #7 · mostly Apache Ofbiz, HTTP Server, Apache HTTP ServerJun 2026: 121 CVEs · 21 critical · 0 now in CISA KEV · rank #7 · mostly Apache Airflow, Apache Activemq, Apache HTTP ServerJul 2026: 181 CVEs · 46 critical · 0 now in CISA KEV · rank #5 · mostly Apache Traffic Server, Apache Camel, Apache ThriftAug 2026: 167 CVEs · 39 critical · 0 now in CISA KEV · rank #7 · mostly Apache Cloudstack, Apache Airflow, Apache CxfSep 2026 so far: 93 CVEs · 33 critical · 0 now in CISA KEV · rank #14 · mostly Apache Syncope, Apache Storm Nimbus, Apache Activemq Artemis
In the lens
The products that kept showing up in Apache-software-foundation's monthly top three from Oct 2021 to Sep 2026. Move the lens and the list follows.
Year by year
Each year's months on the top 200 list. Pick a year to read it in the lens.
The record
- Peak rank
- #5 in Jul 2026
- Busiest month
- Jul 2026, 181 CVEs
- Months with a KEV entry
- 32 of 140 on the list
- On the top 200 list
- 140 of 247 monthly snapshots