2026 CVE Database
Every Critical and High CVE published in 2026, with the signals you need to decide what to fix first.
67 CVEs found
| CVE | Severity | Product | Weakness | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-92414 Apache Jackrabbit | CRITICAL9.3 | Apache Jackrabbit | CWE-384 | 0.7% | Oct 7, 2026 |
| CVE-2026-104714 Apache Struts | HIGH8.8 | Apache Struts | CWE-362 Race Condition | 0.7% | Oct 5, 2026 |
| CVE-2026-87976 Apache Nifi | HIGH7.2 | Apache Nifi | CWE-22 Path Traversal | 0.8% | Sep 16, 2026 |
| CVE-2026-82617 Apache Opennlp | CRITICAL10.0 | Apache Opennlp | CWE-1333 | 0.8% | Sep 11, 2026 |
| CVE-2026-71257 Apache Wicket | HIGH7.5 | Apache Wicket | CWE-770 Allocation Without Limits | 0.7% | Aug 31, 2026 |
| CVE-2026-75020 Apache Apisix | HIGH7.0 | Apache Apisix | CWE-90 | 0.5% | Aug 27, 2026 |
| CVE-2026-75005 Apache Apisix | HIGH8.7 | Apache Apisix | CWE-407 | 0.7% | Aug 27, 2026 |
| CVE-2026-74848 Apache Apisix | HIGH7.0 | Apache Apisix | CWE-444 | 0.6% | Aug 27, 2026 |
| CVE-2026-58076 Apache Airflow | HIGH8.8 | Apache Airflow | CWE-502 Deserialization of Untrusted Data | 0.5% | Aug 12, 2026 |
| CVE-2026-61483 Apache Lucy | HIGH7.5 | Apache Lucy | CWE-674 | 1.0% | Aug 5, 2026 |
| CVE-2026-68073 Apache Qpid Broker-J | HIGH7.5 | Apache Qpid Broker-J | CWE-674 | 0.8% | Aug 5, 2026 |
| CVE-2026-68981 Apache Nifi | HIGH8.8 | Apache Nifi | CWE-409 | 0.7% | Aug 3, 2026 |
| CVE-2026-58185 Apache Traffic Server | HIGH8.2 | Apache Traffic Server | CWE-416 Use After Free | 0.6% | Jul 29, 2026 |
| CVE-2026-58184 Apache Traffic Server | HIGH8.3 | Apache Traffic Server | CWE-787 Out of Bounds Write | 0.6% | Jul 29, 2026 |
| CVE-2026-58183 Apache Traffic Server | HIGH8.2 | Apache Traffic Server | CWE-20 Improper Input Validation | 0.7% | Jul 29, 2026 |
| CVE-2026-58179 Apache Traffic Server | CRITICAL9.2 | Apache Traffic Server | CWE-121 Stack Buffer Overflow | 0.6% | Jul 29, 2026 |
| CVE-2026-58177 Apache Traffic Server | HIGH8.3 | Apache Traffic Server | CWE-787 Out of Bounds Write | 0.6% | Jul 29, 2026 |
| CVE-2026-58163 Apache Traffic Server | HIGH8.3 | Apache Traffic Server | CWE-502 Deserialization of Untrusted Data | 0.7% | Jul 29, 2026 |
| CVE-2026-33267 Apache Traffic Server | HIGH7.7 | Apache Traffic Server | CWE-20 Improper Input Validation | 0.6% | Jul 29, 2026 |
| CVE-2026-58662 Apache Thrift | HIGH8.7 | Apache Thrift | CWE-125 Out of Bounds Read | 1.1% | Jul 27, 2026 |
| CVE-2026-58389 Apache Thrift | HIGH8.7 | Apache Thrift | CWE-770 Allocation Without Limits | 1.0% | Jul 27, 2026 |
| CVE-2026-55971 Apache Thrift | CRITICAL9.3 | Apache Thrift | CWE-122 Heap Buffer Overflow | 1.0% | Jul 27, 2026 |
| CVE-2026-55969 Apache Thrift | HIGH8.7 | Apache Thrift | CWE-190 Integer Overflow | 1.0% | Jul 27, 2026 |
| CVE-2026-55968 Apache Thrift | HIGH8.7 | Apache Thrift | CWE-407 | 1.0% | Jul 27, 2026 |
| CVE-2026-48586 Apache Thrift | HIGH8.7 | Apache Thrift | CWE-409 | 1.0% | Jul 27, 2026 |
| CVE-2026-48145 Apache Thrift | HIGH8.2 | Apache Thrift | CWE-297 | 0.4% | Jul 27, 2026 |
| CVE-2026-48144 Apache Thrift | CRITICAL9.1 | Apache Thrift | CWE-297 | 0.4% | Jul 27, 2026 |
| CVE-2026-43871 Apache Thrift | HIGH8.7 | Apache Thrift | CWE-835 | 1.0% | Jul 27, 2026 |
| CVE-2026-41608 Apache Thrift | HIGH7.5 | Apache Thrift | CWE-409 | 1.0% | Jul 27, 2026 |
| CVE-2026-62392 Apache Kylin | CRITICAL9.8 | Apache Kylin | CWE-78 OS Command Injection | 2.5% | Jul 14, 2026 |
| CVE-2026-62390 Apache Kylin | CRITICAL9.8 | Apache Kylin | CWE-89 SQL Injection | 0.7% | Jul 14, 2026 |
| CVE-2026-58319 Apache Doris | CRITICAL9.1 | Apache Doris | CWE-306 Missing Authentication | 0.7% | Jul 14, 2026 |
| CVE-2026-59245 Apache-Airflow-Providers-Fab | HIGH8.1 | Apache-Airflow-Providers-Fab | CWE-269 Improper Privilege Management | 0.6% | Jul 13, 2026 |
| CVE-2026-58065 Apache-Airflow-Providers-Git | HIGH8.1 | Apache-Airflow-Providers-Git | CWE-322 | 0.7% | Jul 13, 2026 |
| CVE-2026-47896 Apache Lucene.Net | HIGH8.9 | Apache Lucene.Net | CWE-22 Path Traversal | 0.8% | Jul 3, 2026 |
| CVE-2026-47897 Apache Lucene.Net | HIGH8.9 | Apache Lucene.Net | CWE-22 Path Traversal | 0.7% | Jul 3, 2026 |
| CVE-2026-44914 Apache Nifi | HIGH7.5 | Apache Nifi | CWE-862 Missing Authorization | 0.7% | Jun 22, 2026 |
| CVE-2026-39999 Apache Apisix | HIGH7.0 | Apache Apisix | CWE-290 | 0.6% | Jun 19, 2026 |
| CVE-2026-49268 Apache Shiro | HIGH8.8 | Apache Shiro | CWE-90 | 0.8% | Jun 17, 2026 |
| CVE-2026-32967 Apache Dolphinscheduler | CRITICAL9.1 | Apache Dolphinscheduler | CWE-863 Incorrect Authorization | 0.5% | Jun 17, 2026 |
| CVE-2026-32966 Apache Dolphinscheduler | CRITICAL9.8 | Apache Dolphinscheduler | CWE-863 Incorrect Authorization | 0.7% | Jun 17, 2026 |
| CVE-2026-50645 Apache Cxf | HIGH7.5 | Apache Cxf | CWE-400 Uncontrolled Resource Consumption | 0.7% | Jun 12, 2026 |
| CVE-2026-50628 Apache Cxf | CRITICAL9.8 | Apache Cxf | CWE-20 Improper Input Validation | 1.0% | Jun 12, 2026 |
| CVE-2026-50627 Apache Cxf | CRITICAL9.1 | Apache Cxf | CWE-289 | 0.8% | Jun 12, 2026 |
| CVE-2026-49875 Apache Cxf | CRITICAL9.8 | Apache Cxf | CWE-611 XML External Entity | 0.8% | Jun 12, 2026 |
| CVE-2026-47342 Apache Ofbiz | HIGH8.8 | Apache Ofbiz | CWE-285 Improper Authorization | 0.6% | Jun 10, 2026 |
| CVE-2026-47430 Apache Cordova Inappbrowser | CRITICAL9.5 | Apache Cordova Inappbrowser | CWE-20 Improper Input Validation | 0.8% | Jun 8, 2026 |
| CVE-2026-44825 Apache Solr | HIGH8.1 | Apache Solr | CWE-798 Hard Coded Credentials | 2.8% | Jun 1, 2026 |
| CVE-2026-35563 Apache Directory Ldap Api | HIGH8.8 | Apache Directory Ldap Api | CWE-297 | 0.3% | Jun 1, 2026 |
| CVE-2026-42782 Apache Syncope | HIGH7.2 | Apache Syncope | CWE-653 | 0.9% | May 25, 2026 |
Page 1 of 2
Your next credential
Earn your free CTEM certification.
Knowing the CVE is step one. Learn to scope, prioritize, validate and mobilize fixes with a free CTEM certification.
Free to takePublicly verifiable
Beginner / Practitioner / Program Leader
Explore certifications