apache poi

Name: apache poi
Brand: apache

productUS

cpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

critical

by severity

0critical1high8medium0low

updated 2026-10-28

vulnerabilities (10)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2014-3529US	medium4.3	12.8% (96th)	—	no fix	2014-09-04	37 versions
CVE-2017-12626US	high7.5	10.1% (96th)	—	3.17	2018-01-29	< 3.17
CVE-2012-0213US	medium5.0	7.50% (94th)	—	no fix	2012-08-07	35 versions
CVE-2014-3574US	medium4.3	7.11% (94th)	—	no fix	2014-09-04	38 versions
CVE-2014-9527US	medium5.0	6.63% (94th)	—	no fix	2015-01-06	≤ 3.11
CVE-2017-5644US	medium5.5	4.59% (92nd)	—	no fix	2017-03-24	≤ 3.14
CVE-2016-5000US	medium5.5	4.15% (91st)	—	no fix	2016-08-05	≤ 3.13
CVE-2022-26336US	medium5.5	1.53% (75th)	—	5.2.1	2022-03-04	< 5.2.1
CVE-2025-31672US	—	1.35% (71st)	—	5.4.0	2025-04-09	< 5.4.0
CVE-2019-12415US	medium5.5	1.00% (63rd)	—	no fix	2019-10-23	≤ 4.1.0

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation3 CVEs
CWE-611Improper Restriction of XML External Entity Reference3 CVEs
CWE-399CWE-3992 CVEs
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')2 CVEs
CWE-400Uncontrolled Resource Consumption1 CVEs
CWE-770Allocation of Resources Without Limits or Throttling1 CVEs
CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.