Original research · Q4 2026
Open source CVE report, Q4 2026
OSSeva's CVE directory lists 481 CVEs across 37 open source technologies, each checked against the CVE API on 28 October 2026. 125 are critical (26%) and 252 were published in 2026. For 219 of them (46%), the directory names at least one affected release line that gets no upstream fix.
Data: OSSeva's CVE directory as it stood on 28 October 2026. Every CVE ID counted was checked against the CVE Services API that day. Published by OSSeva, which sells extended support for these technologies.
CVEs across 37 technologies, all verified against the CVE API
critical: 125 CVEs with CVSS 9.0 or higher
published in 2026, 52% of the directory
219 CVEs leave at least one affected line with no upstream fix
Key findings
- OSSeva's CVE directory lists 481 CVEs across 37 open source technologies, published between 8 January 2016 and 28 September 2026.
- 125 of the 481 CVEs (26%) are critical, with a CVSS base score of 9.0 or higher. 4 score a full 10.0.
- 272 (57%) are high severity and 84 (17%) are medium. The median CVSS score is 8.1.
- 252 of the 481 CVEs (52%) were published in 2026, and RabbitMQ had the most of them: 33.
- For 219 CVEs (46%), the upstream project shipped no fix for at least one affected release line, usually because that line had reached end of life. 39 of those are critical.
- For 48 CVEs, part of the upstream fix was released only to commercial or Enterprise customers (HashiCorp Consul, Hazelcast, RabbitMQ, Spring Boot, Spring Security).
CVEs by severity
397 of the 481 CVEs (83%) are high or critical. Severity here is the CVSS base-score band: critical is 9.0 to 10.0, high 7.0 to 8.9, medium 4.0 to 6.9.
| Severity | CVSS band | CVEs | Share |
|---|---|---|---|
| Critical | 9.0 to 10.0 | 125 | 26% |
| High | 7.0 to 8.9 | 272 | 57% |
| Medium | 4.0 to 6.9 | 84 | 17% |
| Total | 481 | 100% |
CVEs by year published
252 CVEs were published in 2026, more than in all earlier years combined. Most of that reflects how the directory is kept: it adds new advisories as they publish, while older years hold mainly the highest-scoring records.
| Year | CVEs | Critical | Share of all CVEs |
|---|---|---|---|
| 2026 | 252 | 51 | 52% |
| 2025 | 57 | 9 | 12% |
| 2024 | 43 | 10 | 9% |
| 2023 | 23 | 4 | 5% |
| 2022 | 24 | 8 | 5% |
| 2021 | 14 | 6 | 3% |
| 2020 | 22 | 9 | 5% |
| 2019 | 10 | 2 | 2% |
| 2018 | 16 | 11 | 3% |
| 2017 | 13 | 10 | 3% |
| 2016 | 7 | 5 | 1% |
Year is the CVE's publication date as recorded in the directory, from NVD.
CVEs by technology
RabbitMQ has the most entries in OSSeva's CVE directory (44), then Apache Tomcat (34) and Erlang/OTP (31). The last column counts CVEs for which the directory names an affected line that gets no upstream fix.
| Technology | CVEs | Critical | High | Medium | Highest CVSS | No upstream fix for a line |
|---|---|---|---|---|---|---|
| RabbitMQ | 44 | 6 | 33 | 5 | 9.8 | 1 |
| Apache Tomcat | 34 | 12 | 22 | 0 | 9.8 | 26 |
| Erlang/OTP | 31 | 6 | 25 | 0 | 10.0 | 18 |
| Apache Camel | 23 | 15 | 5 | 3 | 10.0 | 10 |
| Apache NiFi | 23 | 5 | 10 | 8 | 9.8 | 10 |
| Apache ActiveMQ | 22 | 5 | 17 | 0 | 10.0 | 9 |
| Apache Storm | 22 | 6 | 7 | 9 | 9.8 | 22 |
| Redis | 18 | 7 | 11 | 0 | 10.0 | 6 |
| ActiveMQ Artemis | 16 | 4 | 6 | 6 | 9.8 | 0 |
| Apache Solr | 16 | 8 | 6 | 2 | 9.8 | 5 |
| Node.js | 16 | 1 | 15 | 0 | 9.1 | 0 |
| Spring Security | 16 | 4 | 11 | 1 | 9.1 | 0 |
| Apache Kafka | 14 | 1 | 9 | 4 | 9.1 | 4 |
| etcd | 13 | 0 | 7 | 6 | 8.8 | 13 |
| HashiCorp Consul | 13 | 0 | 3 | 10 | 8.3 | 2 |
| Apache Pulsar | 12 | 3 | 6 | 3 | 9.9 | 12 |
| ClickHouse | 12 | 1 | 9 | 2 | 9.8 | 12 |
| PostgreSQL | 11 | 0 | 11 | 0 | 8.8 | 11 |
| Spring Framework | 11 | 11 | 0 | 0 | 9.8 | 0 |
| .NET | 10 | 4 | 6 | 0 | 9.9 | 0 |
| Apache Hadoop | 10 | 3 | 6 | 1 | 9.8 | 10 |
| Apache Hive | 10 | 3 | 3 | 4 | 9.8 | 2 |
| Apache ZooKeeper | 10 | 2 | 8 | 0 | 9.1 | 0 |
| Elasticsearch | 10 | 0 | 5 | 5 | 8.8 | 8 |
| GemFire / Geode | 10 | 3 | 4 | 3 | 9.8 | 8 |
| MongoDB | 10 | 2 | 8 | 0 | 9.8 | 2 |
| Spring Boot | 10 | 4 | 5 | 1 | 9.8 | 0 |
| Apache Druid | 9 | 2 | 2 | 5 | 9.8 | 9 |
| Hazelcast | 6 | 2 | 3 | 1 | 9.8 | 6 |
| Apache Ignite | 5 | 4 | 0 | 1 | 9.8 | 5 |
| Apache Flink | 4 | 0 | 3 | 1 | 8.1 | 4 |
| Apache HBase | 3 | 0 | 2 | 1 | 8.1 | 3 |
| Apache Tomcat Native | 3 | 1 | 2 | 0 | 9.1 | 0 |
| Apache Flink CDC | 1 | 0 | 1 | 0 | 8.8 | 0 |
| Apache Flink Kubernetes Operator | 1 | 0 | 0 | 1 | 6.5 | 0 |
| Apache Flink Stateful Functions | 1 | 0 | 0 | 1 | 6.1 | 0 |
| Apache NiFi Registry | 1 | 0 | 1 | 0 | 8.1 | 1 |
Technology names are as the directory files them. Each CVE is listed individually in the vulnerability directory.
Release lines that get no upstream fix
219 of the 481 CVEs (46%) affect at least one release line its project did not fix, across 26 technologies. The lines below are the ones the directory's fix notes name. Most are past their community end-of-life date; check yours on the EOL tracker.
| Technology | CVEs with an unfixed line | Lines with no upstream fix |
|---|---|---|
| Apache Tomcat | 26 | 8.5, 10.0 and 7.0; Tomcat Native 1.1 and 1.2 |
| Apache Storm | 22 | 2.x, including the final 2.8.9 |
| Erlang/OTP | 18 | OTP 26 and earlier |
| etcd | 13 | 3.4 and earlier |
| Apache Pulsar | 12 | Lines without a listed fixed release |
| ClickHouse | 12 | Lines not on the supported list in ClickHouse's SECURITY.md |
| PostgreSQL | 11 | 13, 12 and 11 |
| Apache Camel | 10 | 2.x, 3.x and expired 4.x LTS lines |
| Apache Hadoop | 10 | Lines without a listed fixed release |
| Apache NiFi | 10 | 1.x |
| Apache ActiveMQ | 9 | 5.18 and older, 6.0 and 6.1 |
| Apache Druid | 9 | Archived releases (only the two latest are offered) |
| Elasticsearch | 8 | 7.x (including 7.10.2), 6.x, and some 8.x and 9.x lines |
| GemFire / Geode | 8 | Geode 1.14 and earlier |
| Hazelcast | 6 | 4.0, 5.1 and earlier, and lines without a listed release |
| Redis | 6 | 7.0 |
| Apache Ignite | 5 | Earlier 2.x minor lines (no 2.x patch release since 2.11.1) |
| Apache Solr | 5 | 8, 7 and 6 |
| Apache Flink | 4 | 1.19 and older |
| Apache Kafka | 4 | Lines before 3.4, 3.7 or 3.9, depending on the CVE |
| Apache HBase | 3 | 2.4 and older |
| Apache Hive | 2 | 1.2, 2.x, 3.x, 4.0 and 4.1 |
| HashiCorp Consul | 2 | 1.19 |
| MongoDB | 2 | 4.2, 4.0 and 3.6 |
| Apache NiFi Registry | 1 | 1.x |
| RabbitMQ | 1 | Lines before 3.11 |
"No upstream fix" is read from each record's fix note, which follows the project's own advisory and support policy. A line can be unfixed for one CVE and fixed for another.
Fixes sold only to paying customers
For 48 CVEs, the upstream fix for some older lines shipped only in commercial or Enterprise releases: HashiCorp Consul, Hazelcast, RabbitMQ, Spring Boot, Spring Security. Community users on those lines must move to a public release that carries the fix, or get the fix another way.
Method
- Data source. OSSeva's CVE directory. Each record carries the CVE ID, the CVSS base score and publication date from NVD (or the CISA-ADP score NVD carries where NVD has none), and affected and fixed versions from the project's own advisory.
- Cut-off. The directory as it stood on 28 October 2026. The newest CVE counted was published on 28 September 2026.
- Verified against the CVE API. Every one of the 487 IDs was requested from the CVE Services API (cveawg.mitre.org/api/cve/<ID>) on 28 October 2026. A CVE was counted only if the record exists, is PUBLISHED rather than REJECTED, and names the directory's technology as the affected product (for older records with no product field, in the CNA description). 481 passed.
- How counted. One CVE counts once, under the technology the directory files it under. Severity is the CVSS band. Year is the publication year. "No upstream fix" means the record's fix note says at least one affected line gets no fix from its project.
The 6 records left out are real, published CVEs, but their affected product is a library or neighbouring project, not the technology they are filed under:
| CVE | Filed under | CVE record names |
|---|---|---|
| CVE-2013-7285 | Apache ActiveMQ | XStream, a Java library |
| CVE-2017-1000190 | Apache Solr | SimpleXML, a Java library |
| CVE-2020-9492 | Apache Solr | Apache Hadoop (WebHDFS client) |
| CVE-2021-20190 | Apache NiFi | jackson-databind, a Java library |
| CVE-2023-44794 | Spring Framework | Dromara Sa-Token |
| CVE-2026-14362 | HashiCorp Consul | hashicorp/memberlist, a shared library |
Since the check, the directory has dropped CVE-2013-7285, CVE-2017-1000190, CVE-2021-20190 and CVE-2023-44794, re-filed CVE-2020-9492 under Apache Hadoop, and kept CVE-2026-14362 under Consul because Consul embeds the affected memberlist library.
Limitations
- This is a curated directory, not a census. It began with the highest-scoring NVD records per technology and has added new advisories, medium severity included, in batches since. Counts by technology and year show what the directory covers, not every CVE ever filed.
- A CVE count is not a risk score. Projects differ in how often they request CVEs, and a 9.8 in a component you do not expose matters less than a 7.5 on your edge.
- No patch-speed figures. The directory holds no OSSeva build timestamps for these records, so this report says nothing about time to patch.
- We sell extended support for most of these technologies. Read the framing with that in mind and check the numbers: every CVE is linked from the directory.
How to cite this report
Quote any finding with the source named, for example: "OSSeva's CVE directory lists 481 CVEs across 37 open source technologies; 26% are critical (OSSeva, Open source CVE report Q4 2026)." Link to https://www.osseva.io/research/open-source-cve-report.
How many CVEs are in OSSeva's CVE directory?
This report counts 481 CVEs across 37 open source technologies, as the directory stood on 28 October 2026. The directory held 487 records that day; 6 were left out because the CVE record names a different product, such as a library the technology depends on.
Which open source technology has the most CVEs in the directory?
RabbitMQ, with 44, followed by Apache Tomcat with 34 and Erlang/OTP with 31. These are counts of what the directory covers, not of every CVE ever filed against each project, so they rank coverage as much as risk.
What does "no upstream fix" mean in this report?
The project published a fix for some release lines but not for every line the CVE affects. The unfixed lines are usually past end of life, such as PostgreSQL 13 and earlier or Tomcat 8.5. Teams on those lines must upgrade, accept the risk, or get a backported fix from a third party. 219 of the 481 CVEs fall into this group.
How were the CVE IDs verified?
A script requested every ID from the CVE Services API at cveawg.mitre.org on 28 October 2026, at no more than four requests a second. A CVE was counted only if its record exists, its state is PUBLISHED rather than REJECTED, and its affected product is the technology the directory files it under. 481 passed; the 6 that did not are listed on this page.
Does this report say how fast OSSeva patches these CVEs?
No. The directory records upstream facts: the CVE, its score, the affected and fixed versions. It does not hold OSSeva build timestamps for these records, so the report makes no claim about time to patch. OSSeva's patch SLA (48 hours for critical CVEs, 7 days for high) is stated on its service pages.
Get a quote
Running a line that gets no upstream fix?
A 15-minute call establishes which of your versions still receive fixes and which CVEs above apply to them.
Prefer to talk or read more first?