This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vendor Profiles

Apache

Number 9 by total vulnerabilities in the catalog.

Computed from the whole catalog when the site is built.

Combines these spellings from source records: Apache, apache

Compare with another vendor

Total vulnerabilities

3,069

Critical

438

High

924

Known Exploited

39

Exploit available

36

Network, no login needed

64.7%

Of 2,150 scored records

New vulnerabilities per year, by severity
  • Critical
  • High
  • Medium
  • Low
  • None or not scored
Show as table
PeriodTotalCriticalHighMediumLowNone or not scored
2026 (incomplete)1,4372686084514268
202521930909450
2024263541029980
2023260457950284
20222202428281139
20211737240160
202063220158
2019103120199
20181670400163
20171573500149
2016421001
2015000000
2014000000
2013110000
2012110000
2011000000
2010000000
2009000000
2008000000
2007000000
2006101000

Top products

ProductTotalCritical/High
Apache Airflow16243
Apache HTTP Server14461
Apache Tomcat14475
Apache Traffic Server11162
Apache OFBiz10142
Apache Camel9948
Apache Thrift9270
Apache Superset659
Apache CXF5835
Apache CloudStack5130

Top bug types

Bug typeTotalCritical/High
Insecure Deserialization160120
Improper Input Validation15179
Memory Corruption14389
Information Disclosure13555
Authentication Issues11366
Cross-Site Scripting10613
Incorrect Authorization10145
Path Traversal7845
Server-Side Request Forgery7640
Missing Authorization7330

Known to be attacked

CVETitlePublishedSeverityEPSS
CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorHigh98.5%
CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansHigh98.3%
CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTCritical99.9%
CVE-2024-45195Apache OFBiz: Confused controller-view authorization logic (forced browsing)Critical100.0%
CVE-2024-38856Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeHigh99.4%
CVE-2024-38475Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.Critical100.0%
CVE-2024-32113Apache OFBiz: Path traversal leading to RCECritical99.9%
CVE-2024-27348Apache HugeGraph-Server: Command execution in gremlinCritical99.2%
CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackCritical100.0%
CVE-2023-33246Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionCritical96.6%

Newest vulnerabilities

CVETitlePublishedSeverityEPSS
CVE-2026-97890Apache TomEE: Session fixation in embedded HTTP serverNonen/a
CVE-2026-97888Apache TomEE: Caller identity leaks across requests in embedded HTTP serverNonen/a
CVE-2026-97881Apache TomEE: Path traversal in embedded HTTP server static resource handlingNonen/a
CVE-2026-97880Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationNonen/a
CVE-2026-97874Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applicationsNonen/a
CVE-2026-97872Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settingsNonen/a
CVE-2026-97870Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP serverNonen/a
CVE-2026-97867Apache TomEE: Database credential disclosure via remote JNDI lookupNonen/a
CVE-2026-97849Apache TomEE: Derby network service listens on all interfacesNonen/a
CVE-2026-87758Apache TomEE: Missing TLS hostname verification in ejbds client connectionsNonen/a