Skip to main content
EVULNABLE
Home

Apache

CVEs currently on EVULNABLE's Priority Feed for Apache, and this vendor's own CISA KEV history.

CISA KEV additions over time

Weekly additions to the KEV catalog, last 26 weeks. Ransomware-linked additions are the base of each bar. Ransomware-linked as currently marked by CISA; recent weeks can rise as CISA updates entries.

20 Apr – 12 Oct; busiest week: 1 added.

Week of 2026-04-20: 0 added to KEV Week of 2026-04-27: 0 added to KEV Week of 2026-05-04: 0 added to KEV Week of 2026-05-11: 0 added to KEV Week of 2026-05-18: 0 added to KEV Week of 2026-05-25: 0 added to KEV Week of 2026-06-01: 0 added to KEV Week of 2026-06-08: 0 added to KEV Week of 2026-06-15: 0 added to KEV Week of 2026-06-22: 0 added to KEV Week of 2026-06-29: 0 added to KEV Week of 2026-07-06: 0 added to KEV Week of 2026-07-13: 0 added to KEV Week of 2026-07-20: 0 added to KEV Week of 2026-07-27: 0 added to KEV Week of 2026-08-03: 1 added to KEV Week of 2026-08-10: 0 added to KEV Week of 2026-08-17: 0 added to KEV Week of 2026-08-24: 0 added to KEV Week of 2026-08-31: 0 added to KEV Week of 2026-09-07: 0 added to KEV Week of 2026-09-14: 0 added to KEV Week of 2026-09-21: 0 added to KEV Week of 2026-09-28: 0 added to KEV Week of 2026-10-05: 1 added to KEV Week of 2026-10-12 (so far): 0 added to KEV
1
0
May
Jun
Jul
Aug
Sep
Oct
  • Not ransomware-linked
  • Ransomware-linked
  • This week (so far)
CISA KEV additions per week, last 26 weeks
Week ofAdded to KEVRansomware-linked
2026-04-2000
2026-04-2700
2026-05-0400
2026-05-1100
2026-05-1800
2026-05-2500
2026-06-0100
2026-06-0800
2026-06-1500
2026-06-2200
2026-06-2900
2026-07-0600
2026-07-1300
2026-07-2000
2026-07-2700
2026-08-0310
2026-08-1000
2026-08-1700
2026-08-2400
2026-08-3100
2026-09-0700
2026-09-1400
2026-09-2100
2026-09-2800
2026-10-0510
2026-10-12 (so far)00

In EVULNABLE's ranked feed

Showing all 41 Apache CVEs in EVULNABLE's ranked feed.

#1 94 Immediate CVE-2017-5638 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Apache — Apache Struts Remote Code Execution Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.99th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#2 94 Immediate CVE-2021-44228 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Apache — Apache Log4j2 Remote Code Execution Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS10.0 (NVD)EPSS99.9% · 99.99th pctlKEV since2021-12-10

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#3 94 Immediate CVE-2021-41773 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Apache — Apache HTTP Server Path Traversal Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.99th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#4 94 Immediate CVE-2021-42013 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Apache — Apache HTTP Server Path Traversal Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.98th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#5 94 Immediate CVE-2023-46604 ExigentKEV since 2023 · listed over a yearRansomwareCISA KEV Apache — Apache ActiveMQ Deserialization of Untrusted Data Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.97th pctlKEV since2023-11-02

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#6 93 Immediate CVE-2021-40438 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Apache — Apache HTTP Server-Side Request Forgery (SSRF) KEV + ransomware, EPSS 99.9%

EVRS 93/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.0 (NVD)EPSS99.9% · 99.99th pctlKEV since2021-12-01

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#7 93 Immediate CVE-2021-45046 ExigentKEV since 2023 · listed over a yearRansomwareCISA KEV Apache — Apache Log4j2 Deserialization of Untrusted Data Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 93/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.0 (NVD)EPSS99.9% · 99.98th pctlKEV since2023-05-01

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#8 91 Immediate CVE-2017-12615 KEV since 2022 · listed over a yearRansomwareCISA KEV Apache — Apache Tomcat on Windows Remote Code Execution Vulnerability KEV + ransomware, EPSS 99.6%

EVRS 91/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.1 (NVD)EPSS99.6% · 99.95th pctlKEV since2022-03-25

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#9 90 Immediate CVE-2016-3081 CISA federal deadline · Overdue by 5 daysCISA KEV Apache — Apache Struts Command Injection Vulnerability KEV, EPSS 96.1%, added to KEV within the last 30 days

EVRS 90/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.1 (NVD)EPSS96.1% · 99.88th pctlKEV since2026-10-08

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.961.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#10 88 Immediate CVE-2025-24813 ExigentKEV since 2025 · listed over a yearCISA KEV Apache — Apache Tomcat Path Equivalence Vulnerability KEV, EPSS 99.9%

EVRS 88/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.97th pctlKEV since2025-04-01

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#11 87 Immediate CVE-2013-2251 ExigentKEV since 2022 · listed over a yearCISA KEV Apache — Apache Struts Improper Input Validation Vulnerability KEV, EPSS 99.9%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.99th pctlKEV since2022-03-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗
#12 87 Immediate CVE-2024-38475 ExigentKEV since 2025 · listed over a yearCISA KEV Apache — Apache HTTP Server Improper Escaping of Output Vulnerability KEV, EPSS 99.9%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.1 (NVD)EPSS99.9% · 99.98th pctlKEV since2025-05-01

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#13 87 Immediate CVE-2024-32113 ExigentKEV since 2024 · listed over a yearCISA KEV Apache — Apache OFBiz Path Traversal Vulnerability KEV, EPSS 99.9%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.97th pctlKEV since2024-08-07

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#14 87 Immediate CVE-2020-13927 ExigentKEV since 2022 · listed over a yearCISA KEV Apache — Apache Airflow's Experimental API Authentication Bypass KEV, EPSS 99.8%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.8% · 99.95th pctlKEV since2022-01-18

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.998.

Full CVE pageNVD ↗CISA KEV ↗
#15 87 Immediate CVE-2024-38856 ExigentKEV since 2024 · listed over a yearCISA KEV Apache — Apache OFBiz Incorrect Authorization Vulnerability KEV, EPSS 99.4%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.4% · 99.94th pctlKEV since2024-08-27

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.994.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#16 87 Immediate CVE-2020-1938 ExigentKEV since 2022 · listed over a yearCISA KEV Apache — Apache Tomcat Improper Privilege Management Vulnerability KEV, EPSS 99.3%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.3% · 99.94th pctlKEV since2022-03-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.993.

Full CVE pageNVD ↗CISA KEV ↗
#17 87 Immediate CVE-2024-27348 ExigentKEV since 2024 · listed over a yearCISA KEV Apache — Apache HugeGraph-Server Improper Access Control Vulnerability KEV, EPSS 99.2%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.2% · 99.94th pctlKEV since2024-09-18

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.992.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#18 87 Immediate CVE-2017-9791 ExigentKEV since 2022 · listed over a yearCISA KEV Apache — Apache Struts 1 Improper Input Validation Vulnerability KEV, EPSS 98.9%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS98.9% · 99.93rd pctlKEV since2022-02-10

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.989.

Full CVE pageNVD ↗CISA KEV ↗
#19 87 Immediate CVE-2016-3088 ExigentKEV since 2022 · listed over a yearCISA KEV Apache — Apache ActiveMQ Improper Input Validation Vulnerability KEV, EPSS 98.5%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS98.5% · 99.92nd pctlKEV since2022-02-10

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.985.

Full CVE pageNVD ↗CISA KEV ↗
#20 86 Immediate CVE-2020-11978 KEV since 2022 · listed over a yearCISA KEV Apache — Apache Airflow Command Injection KEV, EPSS 99.2%

EVRS 86/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS99.2% · 99.94th pctlKEV since2022-01-18

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.992.

Full CVE pageNVD ↗CISA KEV ↗
#21 86 Immediate CVE-2023-27524 ExigentKEV since 2024 · listed over a yearCISA KEV Apache — Apache Superset Insecure Default Initialization of Resource Vulnerability KEV, EPSS 97.4%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS97.4% · 99.9th pctlKEV since2024-01-08

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.974.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#22 86 Immediate CVE-2023-33246 ExigentKEV since 2023 · listed over a yearCISA KEV Apache — Apache RocketMQ Command Execution Vulnerability KEV, EPSS 96.6%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS96.6% · 99.88th pctlKEV since2023-09-06

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.966.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#23 86 Immediate CVE-2022-24112 ExigentKEV since 2022 · listed over a yearCISA KEV Apache — Apache APISIX Authentication Bypass Vulnerability KEV, EPSS 96.1%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS96.1% · 99.88th pctlKEV since2022-08-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.961.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#24 86 Immediate CVE-2020-17530 ExigentKEV since 2021 · listed over a yearCISA KEV Apache — Apache Struts Remote Code Execution Vulnerability KEV, EPSS 95.9%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS95.9% · 99.88th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.959.

Full CVE pageNVD ↗CISA KEV ↗
#25 85 Immediate CVE-2018-11776 KEV since 2021 · listed over a yearCISA KEV Apache — Apache Struts Remote Code Execution Vulnerability KEV, EPSS 99.9%

EVRS 85/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.1 (NVD)EPSS99.9% · 99.99th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗
#26 85 Immediate CVE-2024-45195 KEV since 2025 · listed over a yearCISA KEV Apache — Apache OFBiz Forced Browsing Vulnerability KEV, EPSS 99.9%

EVRS 85/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS99.9% · 99.98th pctlKEV since2025-02-04

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#27 85 Immediate CVE-2017-12617 KEV since 2022 · listed over a yearCISA KEV Apache — Apache Tomcat Remote Code Execution Vulnerability KEV, EPSS 99.9%

EVRS 85/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.1 (NVD)EPSS99.9% · 99.98th pctlKEV since2022-03-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.

Full CVE pageNVD ↗CISA KEV ↗
#28 85 Immediate CVE-2017-9805 KEV since 2021 · listed over a yearCISA KEV Apache — Apache Struts Deserialization of Untrusted Data Vulnerability KEV, EPSS 99.4%

EVRS 85/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.1 (NVD)EPSS99.4% · 99.94th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.994.

Full CVE pageNVD ↗CISA KEV ↗
#29 85 Immediate CVE-2020-1956 KEV since 2022 · listed over a yearCISA KEV Apache — Apache Kylin OS Command Injection Vulnerability KEV, EPSS 97.3%

EVRS 85/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS97.3% · 99.9th pctlKEV since2022-03-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.973.

Full CVE pageNVD ↗CISA KEV ↗
#30 85 Immediate CVE-2016-4437 ExigentKEV since 2021 · listed over a yearCISA KEV Apache — Apache Shiro Code Execution Vulnerability KEV, EPSS 93.0%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS93.0% · 99.83rd pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.930.

Full CVE pageNVD ↗CISA KEV ↗
#31 85 Immediate CVE-2022-24706 ExigentKEV since 2022 · listed over a yearCISA KEV Apache — Apache CouchDB Insecure Default Initialization of Resource Vulnerability KEV, EPSS 92.5%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS92.5% · 99.83rd pctlKEV since2022-08-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.925.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#32 85 Immediate CVE-2016-8735 ExigentKEV since 2023 · listed over a yearCISA KEV Apache — Apache Tomcat Remote Code Execution Vulnerability KEV, EPSS 90.3%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS90.3% · 99.8th pctlKEV since2023-05-12

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.903.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#33 84 Urgent CVE-2019-17558 KEV since 2021 · listed over a yearCISA KEV Apache — Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability KEV, EPSS 98.6%

EVRS 84/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS98.6% · 99.92nd pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.986.

Full CVE pageNVD ↗CISA KEV ↗
#34 84 Urgent CVE-2022-33891 KEV since 2023 · listed over a yearCISA KEV Apache — Apache Spark Command Injection Vulnerability KEV, EPSS 93.2%

EVRS 84/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS93.2% · 99.84th pctlKEV since2023-03-07

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.932.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#35 83 Urgent CVE-2020-17519 KEV since 2024 · listed over a yearCISA KEV Apache — Apache Flink Improper Access Control Vulnerability KEV, EPSS 97.8%

EVRS 83/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS97.8% · 99.91st pctlKEV since2024-05-23

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.978.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#36 81 Urgent CVE-2012-0391 KEV since 2022 · listed over a yearCISA KEV Apache — Apache Struts 2 Improper Input Validation Vulnerability KEV, EPSS 75.6%

EVRS 81/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS75.6% · 99.52nd pctlKEV since2022-01-21

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.756.

Full CVE pageNVD ↗CISA KEV ↗
#37 79 Urgent CVE-2019-0193 KEV since 2021 · listed over a yearCISA KEV Apache — Apache Solr DataImportHandler Code Injection Vulnerability KEV, EPSS 83.5%

EVRS 79/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.2 (NVD)EPSS83.5% · 99.69th pctlKEV since2021-12-10

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.835.

Full CVE pageNVD ↗CISA KEV ↗
#38 75 Urgent CVE-2019-0211 KEV since 2021 · listed over a yearCISA KEV Apache — Apache HTTP Server Privilege Escalation Vulnerability KEV, EPSS 65.0%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.8 (NVD)EPSS65.0% · 99.25th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.650.

Full CVE pageNVD ↗CISA KEV ↗
#39 75 Urgent CVE-2006-1547 KEV since 2022 · listed over a yearCISA KEV Apache — Apache Struts 1 ActionForm Denial-of-Service Vulnerability KEV, EPSS 54.6%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS54.6% · 99.01st pctlKEV since2022-01-21

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.546.

Full CVE pageNVD ↗CISA KEV ↗
#40 75 Urgent CVE-2026-34197 CISA federal deadline · Overdue by 6 monthsCISA KEV Apache — Apache ActiveMQ Improper Input Validation Vulnerability KEV, EPSS 15.5%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS15.5% · 96.8th pctlKEV since2026-04-16

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.155.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#41 75 Urgent CVE-2026-34486 CISA federal deadline · Overdue by 2 monthsCISA KEV Apache — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability KEV, EPSS 6.6%, added to KEV within the last 90 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS6.6% · 93.7th pctlKEV since2026-08-04

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.066.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗