Apache Uses LLMs for vuln discovery

CPE vendor key: apache · 1,321 CVEs published in the last 24 months.

CVEs (365 d)

1,104

▲ +109 vs prior 30d

Avg CVSS (365 d)

7.38

over 1,104 CVEs

Avg EPSS pct (365 d)

0.45

higher = more likely exploited

KEV hit rate (365 d)

0.2%

2 of 1,104 added to CISA KEV

LLM-credited CVEs

Anthropic 13

Monthly CVE volume — last 24 months

Each point is one calendar month. Bars in the severity card to the right slice the same volume by CVSS band.

Severity mix

Stacked by CVSS band (Critical / High / Medium / Low) using the best available metric per CVE.

Top affected products (24 mo)

airflow

tomcat

camel

http_server

traffic_server

cloudstack

cxf

ofbiz

activemq

thrift

Distinct CVEs that include each product in their CPE configuration.

Top CWEs (24 mo)

Distinct CVEs assigned each weakness.

Recent CISA KEV adds (last 12 months)

Added	CVE	Product	KEV name
2026-10-08	CVE-2016-3081	Struts	Apache Struts Command Injection Vulnerability
2026-08-04	CVE-2026-34486	Tomcat	Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
2026-04-16	CVE-2026-34197	ActiveMQ	Apache ActiveMQ Improper Input Validation Vulnerability

Filtered to KEV entries whose CISA vendor or product name matches this vendor exactly, to drop cross-OS noise (e.g. third-party Windows apps that CPE-map to Microsoft).

Known exploited, all time (46)

Published	CVE
2026-04-09	CVE-2026-34486
2026-04-07	CVE-2026-34197
2025-03-10	CVE-2025-24813
2024-09-04	CVE-2024-45195
2024-08-05	CVE-2024-38856
2024-07-01	CVE-2024-38475
2024-05-08	CVE-2024-32113
2024-04-22	CVE-2024-27348
2023-10-27	CVE-2023-46604
2023-10-10	CVE-2023-44487
2023-05-24	CVE-2023-33246
2023-04-24	CVE-2023-27524
2022-07-18	CVE-2022-33891
2022-04-26	CVE-2022-24706
2022-02-11	CVE-2022-24112
2021-12-14	CVE-2021-45046
2021-12-10	CVE-2021-44228
2021-10-07	CVE-2021-42013
2021-10-05	CVE-2021-41773
2021-09-16	CVE-2021-40438
2021-02-16	CVE-2021-21315
2021-01-05	CVE-2020-17519
2020-12-11	CVE-2020-17530
2020-11-10	CVE-2020-13927
2020-07-17	CVE-2020-11978
2020-05-22	CVE-2020-1956
2020-02-24	CVE-2020-1938
2019-12-30	CVE-2019-17558
2019-08-28	CVE-2019-15752
2019-08-01	CVE-2019-0193
2019-04-08	CVE-2019-0211
2018-08-22	CVE-2018-11776
2018-04-11	CVE-2018-1273
2017-10-04	CVE-2017-12617
2017-09-19	CVE-2017-12615
2017-09-15	CVE-2017-9805
2017-07-10	CVE-2017-9791
2017-04-06	CVE-2016-8735
2017-03-11	CVE-2017-5638
2016-06-07	CVE-2016-4437
2016-06-01	CVE-2016-3088
2016-04-26	CVE-2016-3081
2016-04-21	CVE-2016-3427
2013-07-20	CVE-2013-2251
2012-01-08	CVE-2012-0391
2006-03-30	CVE-2006-1547

Attributed by CPE rather than by CISA's vendor name, so it includes CVEs filed under another vendor whose affected-product list names this one — shared library code is the usual reason. Broader, and noisier, than the name-matched card above on purpose.

LLM-credited CVEs from this vendor

Published	CVE	LLM family	Model(s)
2026-09-14	CVE-2026-82438	anthropic	Claude
2026-09-14	CVE-2026-82437	anthropic	Claude
2026-09-14	CVE-2026-82435	anthropic	Claude
2026-09-14	CVE-2026-82434	anthropic	Claude
2026-09-14	CVE-2026-82433	anthropic	Claude
2026-09-14	CVE-2026-82432	anthropic	Claude
2026-09-14	CVE-2026-82431	anthropic	Claude
2026-09-14	CVE-2026-82430	anthropic	Claude
2026-09-14	CVE-2026-82429	anthropic	Claude
2026-09-14	CVE-2026-82428	anthropic	Claude
2026-09-14	CVE-2026-82427	anthropic	Claude
2026-09-14	CVE-2026-82426	anthropic	Claude
2026-09-14	CVE-2026-82439	anthropic	Claude

From mythos_attributed_cves: CVEs whose NVD description or vendor advisory credits an LLM-assisted discovery. Confidence is high for every row.

Generated 16 October 2026 12:22 UTC .