{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Apache vulnerabilities","home_page_url":"https://patchfirst.co/vendor/apache/","feed_url":"https://patchfirst.co/feed/vendor/apache.json","description":"New and newly exploited Apache CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-105944","url":"https://patchfirst.co/cve/CVE-2026-105944/","title":"CVE-2026-105944: Apache Pulsar Manager is a web console for administering Apache Pulsar clusters","content_text":"Apache Software Foundation · Apache Pulsar Manager. Not in CISA KEV. EPSS 0.7% (higher than 53.3% of CVEs). CVSS 10.0 CRITICAL. Priority 19.6 of 100.","summary":"Apache Pulsar Manager is a web console for administering Apache Pulsar clusters","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-23T22:16:52.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.6,"kev":null,"epss":{"score":0.00703,"percentile":0.53266},"cvss":{"score":10,"severity":"CRITICAL","version":"4.0"},"vendor":"Apache Software Foundation","product":"Apache Pulsar Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-111813","url":"https://patchfirst.co/cve/CVE-2026-111813/","title":"CVE-2026-111813: Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert…","content_text":"Apache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.5% (higher than 42.1% of CVEs). CVSS 10.0 CRITICAL. Priority 17.3 of 100.","summary":"Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert…","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-26T10:10:00.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.3,"kev":null,"epss":{"score":0.00489,"percentile":0.42064},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Traffic Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-111812","url":"https://patchfirst.co/cve/CVE-2026-111812/","title":"CVE-2026-111812: Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers…","content_text":"Apache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.4% (higher than 29.9% of CVEs). CVSS 10.0 CRITICAL. Priority 14.9 of 100.","summary":"Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers…","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-23T12:18:08.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.9,"kev":null,"epss":{"score":0.00361,"percentile":0.2988},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Traffic Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-86249","url":"https://patchfirst.co/cve/CVE-2026-86249/","title":"CVE-2026-86249: On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service…","content_text":"Apache Software Foundation · Apache bRPC. Not in CISA KEV. EPSS 0.3% (higher than 25.6% of CVEs). CVSS 9.1 CRITICAL. Priority 13.4 of 100.","summary":"On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service…","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-30T17:17:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.4,"kev":null,"epss":{"score":0.00325,"percentile":0.25557},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache bRPC","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-111816","url":"https://patchfirst.co/cve/CVE-2026-111816/","title":"CVE-2026-111816: Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the…","content_text":"Apache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.3% (higher than 23.7% of CVEs). CVSS 9.3 CRITICAL. Priority 13.2 of 100.","summary":"Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the…","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-26T10:10:00.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.2,"kev":null,"epss":{"score":0.00308,"percentile":0.23698},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Traffic Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-105869","url":"https://patchfirst.co/cve/CVE-2026-105869/","title":"CVE-2026-105869: Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON…","content_text":"Apache Software Foundation · Apache Pulsar. Not in CISA KEV. EPSS 0.3% (higher than 23.1% of CVEs). CVSS 9.2 CRITICAL. Priority 13.0 of 100.","summary":"Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON…","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-30T19:18:00.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13,"kev":null,"epss":{"score":0.00303,"percentile":0.23133},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"vendor":"Apache Software Foundation","product":"Apache Pulsar","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-59562","url":"https://patchfirst.co/cve/CVE-2026-59562/","title":"CVE-2026-59562: Missing authentication for critical function vulnerability in Apache IoTDB","content_text":"Apache Software Foundation · Apache IoTDB. Not in CISA KEV. EPSS 0.3% (higher than 20.9% of CVEs). CVSS 9.8 CRITICAL. Priority 13.0 of 100.","summary":"Missing authentication for critical function vulnerability in Apache IoTDB","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-30T18:17:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13,"kev":null,"epss":{"score":0.00283,"percentile":0.20868},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache IoTDB","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-58663","url":"https://patchfirst.co/cve/CVE-2026-58663/","title":"CVE-2026-58663: An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB…","content_text":"Apache Software Foundation · Apache IoTDB. Not in CISA KEV. EPSS 0.3% (higher than 20% of CVEs). CVSS 9.8 CRITICAL. Priority 12.8 of 100.","summary":"An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB…","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-30T18:17:33.000Z","tags":[],"_patchfirst":{"reason":"published","priority":12.8,"kev":null,"epss":{"score":0.00276,"percentile":0.20035},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache IoTDB","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-111815","url":"https://patchfirst.co/cve/CVE-2026-111815/","title":"CVE-2026-111815: Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate…","content_text":"Apache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.2% (higher than 14.5% of CVEs). CVSS 10.0 CRITICAL. Priority 11.8 of 100.","summary":"Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate…","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-23T12:18:09.000Z","tags":[],"_patchfirst":{"reason":"published","priority":11.8,"kev":null,"epss":{"score":0.00235,"percentile":0.14537},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Traffic Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-111814","url":"https://patchfirst.co/cve/CVE-2026-111814/","title":"CVE-2026-111814: Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one…","content_text":"Apache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.2% (higher than 14.5% of CVEs). CVSS 10.0 CRITICAL. Priority 11.8 of 100.","summary":"Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one…","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-23T12:18:09.000Z","tags":[],"_patchfirst":{"reason":"published","priority":11.8,"kev":null,"epss":{"score":0.00235,"percentile":0.14537},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Traffic Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-111809","url":"https://patchfirst.co/cve/CVE-2026-111809/","title":"CVE-2026-111809: Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding","content_text":"Apache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.2% (higher than 12.4% of CVEs). CVSS 9.3 CRITICAL. Priority 10.9 of 100.","summary":"Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding","date_published":"2026-10-21T00:00:00.000Z","date_modified":"2026-10-28T02:17:01.000Z","tags":[],"_patchfirst":{"reason":"published","priority":10.9,"kev":null,"epss":{"score":0.00218,"percentile":0.12362},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Traffic Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-101296","url":"https://patchfirst.co/cve/CVE-2026-101296/","title":"CVE-2026-101296: A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with…","content_text":"Apache Software Foundation · Apache Tomcat. Not in CISA KEV. EPSS 0.6% (higher than 50% of CVEs). CVSS 9.1 CRITICAL. Priority 18.3 of 100.","summary":"A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with…","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T04:16:58.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18.3,"kev":null,"epss":{"score":0.00627,"percentile":0.50041},"cvss":{"score":9.1,"severity":"CRITICAL","version":"4.0"},"vendor":"Apache Software Foundation","product":"Apache Tomcat","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-86471","url":"https://patchfirst.co/cve/CVE-2026-86471/","title":"CVE-2026-86471: An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server…","content_text":"Apache Software Foundation · Apache CouchDB. Not in CISA KEV. EPSS 0.6% (higher than 49% of CVEs). CVSS 9.3 CRITICAL. Priority 18.2 of 100.","summary":"An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server…","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-21T04:18:11.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18.2,"kev":null,"epss":{"score":0.00606,"percentile":0.48974},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"vendor":"Apache Software Foundation","product":"Apache CouchDB","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-103119","url":"https://patchfirst.co/cve/CVE-2026-103119/","title":"CVE-2026-103119: Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response…","content_text":"Apache Software Foundation · Apache Tomcat. Not in CISA KEV. EPSS 0.6% (higher than 48% of CVEs). CVSS 9.1 CRITICAL. Priority 17.9 of 100.","summary":"Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response…","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-20T19:35:38.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.9,"kev":null,"epss":{"score":0.00586,"percentile":0.48007},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Tomcat","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-101356","url":"https://patchfirst.co/cve/CVE-2026-101356/","title":"CVE-2026-101356: Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous…","content_text":"Apache Software Foundation · Apache Tomcat. Not in CISA KEV. EPSS 0.5% (higher than 42.7% of CVEs). CVSS 9.1 CRITICAL. Priority 16.8 of 100.","summary":"Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous…","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-20T19:35:38.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.8,"kev":null,"epss":{"score":0.00499,"percentile":0.42746},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Tomcat","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-78162","url":"https://patchfirst.co/cve/CVE-2026-78162/","title":"CVE-2026-78162: Deserialization of Untrusted Data vulnerability in Apache Camel","content_text":"Apache Software Foundation · Apache Camel. Not in CISA KEV. EPSS 0.9% (higher than 60.2% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 25.8 of 100.","summary":"Deserialization of Untrusted Data vulnerability in Apache Camel","date_published":"2026-10-19T00:00:00.000Z","date_modified":"2026-10-20T04:17:02.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":25.8,"kev":null,"epss":{"score":0.00918,"percentile":0.60207},"cvss":{"score":10,"severity":"CRITICAL","version":"4.0"},"vendor":"Apache Software Foundation","product":"Apache Camel","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-90910","url":"https://patchfirst.co/cve/CVE-2026-90910/","title":"CVE-2026-90910: Missing authentication for critical function vulnerability in Apache Answer","content_text":"Apache Software Foundation · Apache Answer. Not in CISA KEV. EPSS 0.5% (higher than 41.4% of CVEs). CVSS 9.8 CRITICAL. Priority 16.9 of 100.","summary":"Missing authentication for critical function vulnerability in Apache Answer","date_published":"2026-10-19T00:00:00.000Z","date_modified":"2026-10-19T20:45:51.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.9,"kev":null,"epss":{"score":0.00479,"percentile":0.41377},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Answer","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-71253","url":"https://patchfirst.co/cve/CVE-2026-71253/","title":"CVE-2026-71253: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon","content_text":"Apache Software Foundation · Apache Johnzon. Not in CISA KEV. EPSS 0.4% (higher than 32% of CVEs). CVSS 9.8 CRITICAL. Priority 15.0 of 100.","summary":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon","date_published":"2026-10-19T00:00:00.000Z","date_modified":"2026-10-20T20:17:24.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15,"kev":null,"epss":{"score":0.0038,"percentile":0.31983},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Johnzon","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-108771","url":"https://patchfirst.co/cve/CVE-2026-108771/","title":"CVE-2026-108771: Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin","content_text":"Apache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.2% (higher than 10.7% of CVEs). CVSS 9.8 CRITICAL. Priority 10.8 of 100.","summary":"Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin","date_published":"2026-10-19T00:00:00.000Z","date_modified":"2026-10-30T17:17:13.000Z","tags":[],"_patchfirst":{"reason":"published","priority":10.8,"kev":null,"epss":{"score":0.00206,"percentile":0.10727},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Kylin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-68573","url":"https://patchfirst.co/cve/CVE-2026-68573/","title":"CVE-2026-68573: Improper Authentication vulnerability in Apache Kylin","content_text":"Apache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.5% (higher than 42.6% of CVEs). CVSS 9.8 CRITICAL. Priority 17.4 of 100.","summary":"Improper Authentication vulnerability in Apache Kylin","date_published":"2026-10-16T00:00:00.000Z","date_modified":"2026-10-20T18:17:21.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.4,"kev":null,"epss":{"score":0.00496,"percentile":0.42553},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Kylin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-64959","url":"https://patchfirst.co/cve/CVE-2026-64959/","title":"CVE-2026-64959: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for…","content_text":"Apache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.4% (higher than 35.9% of CVEs). CVSS 9.8 CRITICAL. Priority 16.1 of 100.","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for…","date_published":"2026-10-16T00:00:00.000Z","date_modified":"2026-10-20T16:17:14.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.1,"kev":null,"epss":{"score":0.00416,"percentile":0.35941},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Kylin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-64610","url":"https://patchfirst.co/cve/CVE-2026-64610/","title":"CVE-2026-64610: Deserialization of Untrusted Data vulnerability in Apache Kylin","content_text":"Apache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.4% (higher than 35.8% of CVEs). CVSS 9.8 CRITICAL. Priority 16.1 of 100.","summary":"Deserialization of Untrusted Data vulnerability in Apache Kylin","date_published":"2026-10-16T00:00:00.000Z","date_modified":"2026-10-20T17:17:41.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.1,"kev":null,"epss":{"score":0.00415,"percentile":0.35764},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Kylin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-108709","url":"https://patchfirst.co/cve/CVE-2026-108709/","title":"CVE-2026-108709: Authentication bypass within in-house network in Apache Kylin","content_text":"Apache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.4% (higher than 34.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.","summary":"Authentication bypass within in-house network in Apache Kylin","date_published":"2026-10-16T00:00:00.000Z","date_modified":"2026-10-20T19:17:28.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00402,"percentile":0.34473},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Kylin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-94134","url":"https://patchfirst.co/cve/CVE-2026-94134/","title":"CVE-2026-94134: The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or…","content_text":"Apache Software Foundation · Apache Airflow SSH provider. Not in CISA KEV. EPSS 0.6% (higher than 48.7% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. Priority 23.3 of 100.","summary":"The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or…","date_published":"2026-10-15T00:00:00.000Z","date_modified":"2026-10-16T15:20:39.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":23.3,"kev":null,"epss":{"score":0.006,"percentile":0.48676},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Airflow SSH provider","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-107460","url":"https://patchfirst.co/cve/CVE-2026-107460/","title":"CVE-2026-107460: Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating)…","content_text":"Apache Software Foundation · Apache Fesod (Incubating). Not in CISA KEV. EPSS 0.4% (higher than 34.9% of CVEs). CVSS 9.1 CRITICAL. Priority 15.5 of 100.","summary":"Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating)…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-20T18:17:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00407,"percentile":0.34937},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Fesod (Incubating)","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-92119","url":"https://patchfirst.co/cve/CVE-2026-92119/","title":"CVE-2026-92119: REST API Mass Assignment vulnerability in Apache Allura","content_text":"Apache Software Foundation · Apache Allura. Not in CISA KEV. EPSS 0.3% (higher than 22.9% of CVEs). CVSS 9.1 CRITICAL. Priority 13.1 of 100.","summary":"REST API Mass Assignment vulnerability in Apache Allura","date_published":"2026-10-12T00:00:00.000Z","date_modified":"2026-10-16T18:19:43.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.1,"kev":null,"epss":{"score":0.00302,"percentile":0.22933},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Allura","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-103501","url":"https://patchfirst.co/cve/CVE-2026-103501/","title":"CVE-2026-103501: Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)","content_text":"Apache Software Foundation · Apache DataSketches. Not in CISA KEV. EPSS 0.6% (higher than 46.3% of CVEs). CVSS 9.8 CRITICAL. Priority 18.6 of 100.","summary":"Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-16T16:16:53.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18.6,"kev":null,"epss":{"score":0.00555,"percentile":0.46307},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache DataSketches","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-103513","url":"https://patchfirst.co/cve/CVE-2026-103513/","title":"CVE-2026-103513: Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)","content_text":"Apache Software Foundation · Apache DataSketches. Not in CISA KEV. EPSS 0.4% (higher than 33.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.","summary":"Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-16T16:16:53.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16,"kev":null,"epss":{"score":0.00394,"percentile":0.33592},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache DataSketches","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-103635","url":"https://patchfirst.co/cve/CVE-2026-103635/","title":"CVE-2026-103635: Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).…","content_text":"Apache Software Foundation · Apache DataSketches. Not in CISA KEV. EPSS 0.4% (higher than 33.6% of CVEs). CVSS 9.1 CRITICAL. Priority 15.5 of 100.","summary":"Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).…","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-16T16:16:53.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00394,"percentile":0.33591},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache DataSketches","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-71575","url":"https://patchfirst.co/cve/CVE-2026-71575/","title":"CVE-2026-71575: The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a…","content_text":"Apache Software Foundation · Apache CXF. Not in CISA KEV. EPSS 0.4% (higher than 29.3% of CVEs). CVSS 9.1 CRITICAL. Priority 14.7 of 100.","summary":"The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a…","date_published":"2026-10-09T00:00:00.000Z","date_modified":"2026-10-16T18:07:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.7,"kev":null,"epss":{"score":0.00356,"percentile":0.29348},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache CXF","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2016-3081#kev","url":"https://patchfirst.co/cve/CVE-2016-3081/","title":"[KEV] CVE-2016-3081: Apache Struts Command Injection Vulnerability","content_text":"Apache · Struts. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 96.5% (higher than 99.88% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.","summary":"Apache Struts Command Injection Vulnerability","date_published":"2026-10-08T00:00:00.000Z","date_modified":"2026-10-09T14:43:05.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.6,"kev":{"dateAdded":"2026-10-08","ransomware":false},"epss":{"score":0.96525,"percentile":0.99882},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Struts","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-92414","url":"https://patchfirst.co/cve/CVE-2026-92414/","title":"CVE-2026-92414: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit","content_text":"Apache Software Foundation · Apache Jackrabbit. Not in CISA KEV. EPSS 0.7% (higher than 54% of CVEs). CVSS 9.1 CRITICAL. Priority 19.3 of 100.","summary":": Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit","date_published":"2026-10-07T00:00:00.000Z","date_modified":"2026-10-13T14:24:57.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.3,"kev":null,"epss":{"score":0.00725,"percentile":0.54038},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Jackrabbit","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-97720","url":"https://patchfirst.co/cve/CVE-2026-97720/","title":"CVE-2026-97720: Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including…","content_text":"Apache Software Foundation · Apache Impala. Not in CISA KEV. EPSS 0.3% (higher than 25.4% of CVEs). CVSS 9.1 CRITICAL. Priority 13.7 of 100.","summary":"Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including…","date_published":"2026-10-07T00:00:00.000Z","date_modified":"2026-10-07T19:17:45.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.7,"kev":null,"epss":{"score":0.00323,"percentile":0.25378},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Impala","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-104711","url":"https://patchfirst.co/cve/CVE-2026-104711/","title":"CVE-2026-104711: Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…","content_text":"Apache Software Foundation · Apache Struts. Not in CISA KEV. EPSS 1.4% (higher than 72.4% of CVEs). CVSS 9.8 CRITICAL. Priority 23.5 of 100.","summary":"Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…","date_published":"2026-10-05T00:00:00.000Z","date_modified":"2026-10-08T19:05:18.000Z","tags":[],"_patchfirst":{"reason":"published","priority":23.5,"kev":null,"epss":{"score":0.01394,"percentile":0.72351},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Struts","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-103877","url":"https://patchfirst.co/cve/CVE-2026-103877/","title":"CVE-2026-103877: Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API","content_text":"Apache Software Foundation · Apache Directory LDAP API. Not in CISA KEV. EPSS 0.5% (higher than 40.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.8 of 100.","summary":"Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-07T23:16:58.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.8,"kev":null,"epss":{"score":0.00469,"percentile":0.40631},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Directory LDAP API","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-91135","url":"https://patchfirst.co/cve/CVE-2026-91135/","title":"CVE-2026-91135: Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport","content_text":"Apache Software Foundation · Apache Thrift. Not in CISA KEV. EPSS 0.3% (higher than 27.3% of CVEs). CVSS 9.2 CRITICAL. Priority 13.7 of 100.","summary":"Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-02T18:17:06.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.7,"kev":null,"epss":{"score":0.00339,"percentile":0.27309},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"vendor":"Apache Software Foundation","product":"Apache Thrift","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-83632","url":"https://patchfirst.co/cve/CVE-2026-83632/","title":"CVE-2026-83632: Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow…","content_text":"Apache Software Foundation · Apache Thrift. Not in CISA KEV. EPSS 0.3% (higher than 22.3% of CVEs). CVSS 9.2 CRITICAL. Priority 12.7 of 100.","summary":"Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow…","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-02T17:17:07.000Z","tags":[],"_patchfirst":{"reason":"published","priority":12.7,"kev":null,"epss":{"score":0.00296,"percentile":0.22315},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"vendor":"Apache Software Foundation","product":"Apache Thrift","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-102795","url":"https://patchfirst.co/cve/CVE-2026-102795/","title":"CVE-2026-102795: Improper Access Control vulnerability in Apache Traffic Server","content_text":"Apache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.3% (higher than 20.9% of CVEs). CVSS 9.3 CRITICAL. Priority 12.4 of 100.","summary":"Improper Access Control vulnerability in Apache Traffic Server","date_published":"2026-10-02T00:00:00.000Z","date_modified":"2026-10-02T19:16:39.000Z","tags":[],"_patchfirst":{"reason":"published","priority":12.4,"kev":null,"epss":{"score":0.00283,"percentile":0.2087},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Traffic Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-57941","url":"https://patchfirst.co/cve/CVE-2026-57941/","title":"CVE-2026-57941: Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue…","content_text":"Apache Software Foundation · Apache HTTP Server. Not in CISA KEV. EPSS 0.6% (higher than 47.3% of CVEs). CVSS 9.8 CRITICAL. Priority 17.9 of 100.","summary":"Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue…","date_published":"2026-10-01T00:00:00.000Z","date_modified":"2026-10-05T13:29:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.9,"kev":null,"epss":{"score":0.00572,"percentile":0.47285},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache HTTP Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-56154","url":"https://patchfirst.co/cve/CVE-2026-56154/","title":"CVE-2026-56154: Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue…","content_text":"Apache Software Foundation · Apache HTTP Server. Not in CISA KEV. EPSS 0.5% (higher than 45.2% of CVEs). CVSS 9.8 CRITICAL. Priority 17.5 of 100.","summary":"Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue…","date_published":"2026-10-01T00:00:00.000Z","date_modified":"2026-10-05T13:33:38.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.5,"kev":null,"epss":{"score":0.00536,"percentile":0.45186},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache HTTP Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-59797","url":"https://patchfirst.co/cve/CVE-2026-59797/","title":"CVE-2026-59797: Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions","content_text":"Apache Software Foundation · Apache HTTP Server. Not in CISA KEV. EPSS 0.5% (higher than 41.8% of CVEs). CVSS 9.8 CRITICAL. Priority 16.8 of 100.","summary":"Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions","date_published":"2026-10-01T00:00:00.000Z","date_modified":"2026-10-05T13:16:52.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.8,"kev":null,"epss":{"score":0.00486,"percentile":0.41788},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache HTTP Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-34486#kev","url":"https://patchfirst.co/cve/CVE-2026-34486/","title":"[KEV] CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","content_text":"Apache · Tomcat. In CISA KEV since 2026-08-04. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1040 Network Sniffing; T1557 Adversary-in-the-Middle. Priority 73.2 of 100.","summary":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","date_published":"2026-08-04T00:00:00.000Z","date_modified":"2026-10-26T22:10:00.000Z","tags":["kev","public-exploit","T1040","T1557"],"_patchfirst":{"reason":"kev","priority":73.2,"kev":{"dateAdded":"2026-08-04","ransomware":false},"epss":{"score":0.98503,"percentile":0.9992},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Tomcat","techniqueIds":["T1040","T1557"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-44825","url":"https://patchfirst.co/cve/CVE-2026-44825/","title":"CVE-2026-44825: Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users","content_text":"Apache Software Foundation · Apache Solr. Not in CISA KEV. EPSS 3.9% (higher than 90.3% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 71.1 of 100.","summary":"Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users","date_published":"2026-06-01T00:00:00.000Z","date_modified":"2026-06-02T03:55:51.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":71.1,"kev":null,"epss":{"score":0.03922,"percentile":0.90329},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Solr","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-33453","url":"https://patchfirst.co/cve/CVE-2026-33453/","title":"CVE-2026-33453: Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote…","content_text":"Apache Software Foundation · Apache Camel. Not in CISA KEV. EPSS 9.2% (higher than 95.3% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 78.3 of 100.","summary":"Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote…","date_published":"2026-04-27T00:00:00.000Z","date_modified":"2026-07-15T01:06:23.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":78.3,"kev":null,"epss":{"score":0.09178,"percentile":0.9532},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Camel","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-40466","url":"https://patchfirst.co/cve/CVE-2026-40466/","title":"CVE-2026-40466: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery…","content_text":"Apache Software Foundation · Apache ActiveMQ Broker. Not in CISA KEV. EPSS 4.8% (higher than 91.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 71.8 of 100.","summary":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery…","date_published":"2026-04-24T00:00:00.000Z","date_modified":"2026-07-15T01:00:57.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":71.8,"kev":null,"epss":{"score":0.04783,"percentile":0.91917},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-34197#kev","url":"https://patchfirst.co/cve/CVE-2026-34197/","title":"[KEV] CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability","content_text":"Apache · ActiveMQ. In CISA KEV since 2026-04-16. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.1 of 100.","summary":"Apache ActiveMQ Improper Input Validation Vulnerability","date_published":"2026-04-16T00:00:00.000Z","date_modified":"2026-10-26T22:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.1,"kev":{"dateAdded":"2026-04-16","ransomware":false},"epss":{"score":0.98256,"percentile":0.99916},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"ActiveMQ","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-15057","url":"https://patchfirst.co/cve/CVE-2016-15057/","title":"CVE-2016-15057: Apache Continuum: Command injection leading to RCE","content_text":"Apache Software Foundation · Apache Continuum. Not in CISA KEV. EPSS 3.9% (higher than 90.2% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 73.0 of 100.","summary":"Apache Continuum: Command injection leading to RCE","date_published":"2026-01-26T00:00:00.000Z","date_modified":"2026-01-26T18:06:06.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":73,"kev":null,"epss":{"score":0.03888,"percentile":0.90226},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Continuum","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-60021","url":"https://patchfirst.co/cve/CVE-2025-60021/","title":"CVE-2025-60021: Apache bRPC: Remote command injection vulnerability in heap builtin service","content_text":"Apache Software Foundation · Apache bRPC. Not in CISA KEV. EPSS 25.5% (higher than 98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 81.5 of 100.","summary":"Apache bRPC: Remote command injection vulnerability in heap builtin service","date_published":"2026-01-16T00:00:00.000Z","date_modified":"2026-02-26T15:04:02.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":81.5,"kev":null,"epss":{"score":0.25519,"percentile":0.97952},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache bRPC","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-68493","url":"https://patchfirst.co/cve/CVE-2025-68493/","title":"CVE-2025-68493: Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component","content_text":"Apache Software Foundation · Apache Struts. Not in CISA KEV. EPSS 50.4% (higher than 98.9% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 73.5 of 100.","summary":"Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component","date_published":"2026-01-11T00:00:00.000Z","date_modified":"2026-09-14T12:04:26.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":73.5,"kev":null,"epss":{"score":0.50424,"percentile":0.98911},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Struts","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-66516","url":"https://patchfirst.co/cve/CVE-2025-66516/","title":"CVE-2025-66516: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of…","content_text":"Apache Software Foundation · Apache Tika core. Not in CISA KEV. EPSS 89.0% (higher than 99.78% of CVEs). CVSS 8.4 HIGH. Public exploit code exists. Priority 32.8 of 100.","summary":"Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of…","date_published":"2025-12-04T00:00:00.000Z","date_modified":"2026-02-26T16:57:34.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":32.8,"kev":null,"epss":{"score":0.88976,"percentile":0.99778},"cvss":{"score":8.4,"severity":"HIGH","version":"3.1"},"vendor":"Apache Software Foundation","product":"Apache Tika core","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}