Apache Software Foundation

Incidents

1. Wednesday, October 21

   • CVE-2026-111813
     Apache Software Foundation Apache Traffic Server

     • Apache Software Foundation Apache Traffic Server
     • Critical
     • CVSS 10.0
     • EPSS 0.35%
     • No fixed version listed
     18:20 UTC
   • CVE-2026-105944
     Apache Software Foundation Apache Pulsar Manager

     • Apache Software Foundation Apache Pulsar Manager
     • Critical
     • CVSS 10.0
     • EPSS 0.7%
     • No fixed version listed
     18:17 UTC
   • CVE-2026-111811
     Apache Software Foundation Apache Traffic Server

     • Apache Software Foundation Apache Traffic Server
     • Critical
     • CVSS 9.4
     • EPSS 0.26%
     • No fixed version listed
     19:17 UTC
   • CVE-2026-111816
     Apache Software Foundation Apache Traffic Server

     • Apache Software Foundation Apache Traffic Server
     • Critical
     • CVSS 9.2
     • EPSS 0.24%
     • No fixed version listed
     18:26 UTC
   • CVE-2026-105869
     Apache Software Foundation Apache Pulsar

     • Apache Software Foundation Apache Pulsar
     • Critical
     • CVSS 9.2
     • EPSS 0.3%
     • Fixed version listed
     17:58 UTC
   • CVE-2026-111815
     Apache Software Foundation Apache Traffic Server

     • Apache Software Foundation Apache Traffic Server
     • High
     • CVSS 7.8
     • EPSS 0.17%
     • No fixed version listed
     19:13 UTC
   • CVE-2026-111814
     Apache Software Foundation Apache Traffic Server

     • Apache Software Foundation Apache Traffic Server
     • High
     • CVSS 7.8
     • EPSS 0.17%
     • No fixed version listed
     19:13 UTC
   • CVE-2026-111812
     Apache Software Foundation Apache Traffic Server

     • Apache Software Foundation Apache Traffic Server
     • High
     • CVSS 7.0
     • EPSS 0.26%
     • No fixed version listed
     19:18 UTC
   • CVE-2026-111809
     Apache Software Foundation Apache Traffic Server

     • Apache Software Foundation Apache Traffic Server
     • Moderate
     • CVSS 6.9
     • EPSS 0.22%
     • No fixed version listed
     19:16 UTC

2. Tuesday, October 20

   • CVE-2026-86471
     Apache Software Foundation Apache CouchDB

     • Apache Software Foundation Apache CouchDB
     • Critical
     • CVSS 9.3
     • EPSS 0.61%
     • Fixed version listed
     15:38 UTC
   • CVE-2026-103119
     Apache Software Foundation Apache Tomcat

     • Apache Software Foundation Apache Tomcat
     • Critical
     • CVSS 9.1
     • EPSS 0.61%
     • No fixed version listed
     13:54 UTC
   • CVE-2026-101356
     Apache Software Foundation Apache Tomcat

     • Apache Software Foundation Apache Tomcat
     • Critical
     • CVSS 9.1
     • EPSS 0.52%
     • No fixed version listed
     13:46 UTC
   • CVE-2026-101296
     Apache Software Foundation Apache Tomcat

     • Apache Software Foundation Apache Tomcat
     • Critical
     • CVSS 9.1
     • EPSS 0.65%
     • No fixed version listed
     13:45 UTC

3. Monday, October 19

   • CVE-2026-78162
     Apache Software Foundation Apache Camel

     • Apache Software Foundation Apache Camel
     • Critical
     • CVSS 10.0
     • EPSS 1.26%
     • Fixed version listed
     10:03 UTC
   • CVE-2026-71253
     Apache Software Foundation Apache Johnzon

     • Apache Software Foundation Apache Johnzon
     • Critical
     • CVSS 9.8
     • EPSS 0.65%
     • Fixed version listed
     10:36 UTC
   • CVE-2026-90910
     Apache Software Foundation Apache Answer

     • Apache Software Foundation Apache Answer
     • Critical
     • CVSS 9.8
     • EPSS 0.64%
     • No fixed version listed
     09:35 UTC

4. Friday, October 16

   • CVE-2026-108709
     Apache Software Foundation Apache Kylin

     • Apache Software Foundation Apache Kylin
     • Critical
     • CVSS 9.8
     • EPSS 0.66%
     • No fixed version listed
     19:38 UTC