Apache Software Foundation vulnerabilities

CVEs per yearBy the year they were published

1. 20161
2. 2017157
3. 2018167
4. 201947
5. 202031
6. 2021172
7. 2022220
8. 2023259
9. 2024261
10. 2025218
11. 20261,303

Known exploitedNewest addition to KEV first

• CVE-2026-34486

  Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

  Apache Software Foundation · Apache Tomcat

  ExploitedHigh7.5
• CVE-2026-34197

  Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

  Apache Software Foundation · Apache ActiveMQ Broker

  ExploitedHigh8.8
• CVE-2024-38475

  Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

  Apache Software Foundation · Apache HTTP Server

  ExploitedCritical9.1
• CVE-2025-24813

  Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

  Apache Software Foundation · Apache Tomcat

  ExploitedCritical10.0
• CVE-2024-45195

  Apache OFBiz: Confused controller-view authorization logic (forced browsing)

  Apache Software Foundation · Apache OFBiz

  ExploitedCritical9.8
• CVE-2024-27348

  Apache HugeGraph-Server: Command execution in gremlin

  Apache Software Foundation · Apache HugeGraph-Server

  ExploitedCritical9.8
• CVE-2024-38856

  Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

  Apache Software Foundation · Apache OFBiz

  ExploitedHigh8.1
• CVE-2024-32113

  Apache OFBiz: Path traversal leading to RCE

  Apache Software Foundation · Apache OFBiz

  ExploitedCritical9.1
• CVE-2020-17519

  Apache Flink directory traversal attack: reading remote files through the REST API

  Apache Software Foundation · Apache Flink

  ExploitedCritical9.1
• CVE-2023-27524

  Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

  Apache Software Foundation · Apache Superset

  ExploitedHigh8.9

Newest CVEs

• CVE-2026-59267

  Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption

  Apache Software Foundation · Apache OpenOffice

  Medium5.8
• CVE-2026-90632

  Apache OpenOffice: Local file inclusion via GStreamer plugin

  Apache Software Foundation · Apache OpenOffice

  Medium5.5
• CVE-2026-90634

  Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files

  Apache Software Foundation · Apache OpenOffice

  High7.3
• CVE-2026-90631

  Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables

  Apache Software Foundation · Apache OpenOffice

  Low3.3
• CVE-2026-90629

  Apache OpenOffice: Out of bounds memory access during WMF import

  Apache Software Foundation · Apache OpenOffice

  High7.3
• CVE-2026-90628

  Apache OpenOffice: Stack overflow in CFF hint handling

  Apache Software Foundation · Apache OpenOffice

  High7.3
• CVE-2026-90627

  Apache OpenOffice: Local file inclusion via SQL provider and flat file database references

  Apache Software Foundation · Apache OpenOffice

  Medium5.5
• CVE-2026-90626

  Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files

  Apache Software Foundation · Apache OpenOffice

  High7.3
• CVE-2026-90624

  Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability

  Apache Software Foundation · Apache OpenOffice

  High7.3
• CVE-2026-59268

  Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader

  Apache Software Foundation · Apache OpenOffice

  High7.3