Apache Security Team

Apache Security Team

Apache Project Security Information

Security information for individual Apache projects

Here is a list of pages ASF projects maintain to provide information on known security vulnerabilities. Each entry also has the security contact for reporting new vulnerabilities related to that project. Note that not all project security teams have a dedicated address for reporting new vulnerabilities.

To report a vulnerability in an Apache project that is not listed below, contact the Apache Security Team.

Use the tabs below to jump to projects by their initial. Every project lists a security contact; some also publish a security page and a list of advisories.

A

Apache Accumulo
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache ActiveMQ
- Security contact:
  security@apache.org
- Advisories:
  activemq.apache.org
- Security model:
  - Apache ActiveMQ security model
Apache AGE
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Airavata
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Airflow
- Security contact:
  security@airflow.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Airflow security model
Apache Allura
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Ambari
- Security contact:
  security@ambari.apache.org
- Advisories (experimental):
  security.apache.org
Apache Answer
- Security contact:
  security@apache.org
- Advisories:
  answer.apache.org
- Security model:
  - Apache Answer security model
Apache Ant
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Ant security model
Apache APISIX
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache APISIX security model
Apache Aries
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Arrow
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Arrow security model
Apache Artemis
- Security contact:
  security@apache.org
- Advisories:
  artemis.apache.org
- Security model:
  - Apache Artemis security model
Apache AsterixDB
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Atlas
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Avro
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Avro security model
Apache Axis
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Axis security model

B

Apache Beam
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Bigtop
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache BookKeeper
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Brooklyn
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache bRPC
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache bRPC security model
Apache BuildStream
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache BVal
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far

C

Apache Calcite
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Camel
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Camel security model
Apache Carbondata
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Carbondata security model
Apache Cassandra
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Cassandra security model
Apache Causeway
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Cayenne
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Celeborn
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Celix
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache CloudStack
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache CloudStack security model
Apache Commons
- Security contact:
  security@commons.apache.org
- Advisories:
  commons.apache.org
- Security models:
Apache Cordova
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache CouchDB
- Security contact:
  security@couchdb.apache.org
- Advisories (experimental):
  security.apache.org
Apache Creadur
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Creadur security model
Apache cTAKES
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Curator
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache CXF
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache CXF security model

D

Apache Daffodil
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache DataFu
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache DataFusion
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache DataSketches
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache DB
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache DB security model
Apache DeltaSpike
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache DevLake
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache DevLake security model
Apache Directory
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Directory security model
Apache DolphinScheduler
- Security contact:
  security@dolphinscheduler.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache DolphinScheduler security model
Apache Doris
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Doris security model
Apache Drill
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Drill security model
Apache Druid
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Druid security model
Apache Dubbo
- Security contact:
  security@dubbo.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Dubbo security model

E

Apache ECharts
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache ECharts security model
Apache Empire-db
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache EventMesh
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org

F

Apache Felix
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Fesod (Incubating)
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Fineract
- Security contact:
  security@fineract.apache.org
- Advisories:
  fineract.apache.org
- Security model:
  - Apache Fineract security model
Apache Flagon
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Flex
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Flink
- Security contact:
  security@apache.org
- Advisories:
  flink.apache.org
- Security model:
  - Apache Flink security model
Apache Fluss (Incubating)
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Fory
- Security contact:
  security@apache.org
- Advisories:
  fory.apache.org
- Security model:
  - Apache Fory security model
Apache FreeMarker
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far

G

Apache Geode
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Geode security model
Apache Geronimo
- Security contact:
  security@geronimo.apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Geronimo security model
Apache Gluten
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Gobblin
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Grails
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Grails security model
Apache Gravitino
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Groovy
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Groovy security model
Apache Guacamole
- Security contact:
  security@guacamole.apache.org
- Advisories:
  guacamole.apache.org
- Security model:
  - Apache Guacamole security model
Apache Gump
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far

H

Apache Hadoop
- Security contact:
  security@hadoop.apache.org
- Advisories:
  hadoop.apache.org
- Security model:
  - Apache Hadoop security model
Apache HBase
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache HBase security model
Apache Helix
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Helix security model
Apache Hertzbeat
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Hertzbeat security model
Apache Hive
- Security contact:
  security@hive.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Hive security model
Apache Hop
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Hop security model
Apache HTTP Server
- Security contact:
  security@httpd.apache.org
- Advisories:
  httpd.apache.org
- Security model:
  - Apache HTTP Server security model
Apache HttpComponents
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache HttpComponents security model
Apache Hudi
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Hudi security model
Apache HugeGraph
- Security contact:
  security@hugegraph.apache.org
- Advisories:
  hugegraph.apache.org
- Security model:
  - Apache HugeGraph security model

I

Apache Iceberg
- Security contact:
  security@iceberg.apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Iceberg security model
Apache Ignite
- Security contact:
  security@ignite.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Ignite security model
Apache Impala
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Impala security model
Apache InLong
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache InLong security model
Apache IoTDB
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache IoTDB security model

J

Apache Jackrabbit
- Security contact:
  security@jackrabbit.apache.org
- Advisories:
  jackrabbit.apache.org
- Security model:
  - Apache Jackrabbit security model
Apache James
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Jena
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Jena security model
Apache JMeter
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache JMeter security model
Apache Johnzon
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Johnzon security model
Apache JSPWiki
- Security contact:
  security@apache.org
- Advisories:
  jspwiki-wiki.apache.org
- Security model:
  - Apache JSPWiki security model
Apache Juneau
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far

K

Apache Kafka
- Security contact:
  security@kafka.apache.org
- Advisories:
  kafka.apache.org
- Security model:
  - Apache Kafka security model
Apache Karaf
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Knox
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Kudu
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Kudu security model
Apache Kvrocks
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Kvrocks security model
Apache Kylin
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Kyuubi
- Security contact:
  security@kyuubi.apache.org
- Advisories (experimental):
  security.apache.org

L

Apache Libcloud
- Security contact:
  security@libcloud.apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Libcloud security model
Apache Linkis
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Livy
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Logging
- Security contact:
  security@logging.apache.org
- Advisories:
  logging.apache.org
- Security model:
  - Apache Logging security model
Apache Lucene
- Security contact:
  security@lucene.apache.org
- Advisories (experimental):
  security.apache.org
Apache Lucene.NET
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org

M

Apache MADlib
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Magpie
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Magpie security model
Apache Mahout
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache ManifoldCF
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Maven
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Maven security model
Apache MINA
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache mod_perl
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache MyFaces
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Mynewt
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org

N

Apache NetBeans
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache NiFi
- Security contact:
  security@nifi.apache.org
- Advisories:
  nifi.apache.org
- Security model:
  - Apache NiFi security model
Apache Nutch
- Security contact:
  security@apache.org
- Advisories:
  nutch.apache.org
- Security model:
  - Apache Nutch security model
Apache NuttX
- Security contact:
  security@nuttx.apache.org
- Advisories:
  nuttx.apache.org
- Security model:
  - Apache NuttX security model

O

Apache OFBiz
- Security contact:
  security@ofbiz.apache.org
- Advisories:
  ofbiz.apache.org
- Security model:
  - Apache OFBiz security model
Apache OpenDAL
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache OpenDAL security model
Apache OpenJPA
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache OpenMeetings
- Security contact:
  security@openmeetings.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache OpenMeetings security model
Apache OpenNLP
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache OpenOffice
- Security contact:
  security@openoffice.apache.org
- Advisories:
  www.openoffice.org
- Security model:
  - Apache OpenOffice security model
Apache OpenWebBeans
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache OpenWhisk
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache ORC
- Security contact:
  security@apache.org
- Advisories:
  orc.apache.org
- Security model:
  - Apache ORC security model
Apache Ozone
- Security contact:
  security@ozone.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Ozone security model

P

Apache Paimon
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Paimon security model
Apache Parquet
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Parquet security model
Apache PDFBox
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache PDFBox security model
Apache Pekko
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Pekko security model
Apache Phoenix
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Pig
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Pinot
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache PLC4X
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache PLC4X security model
Apache POI
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache POI security model
Apache Polaris
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Polaris security model
Apache Pony Mail
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Portable Runtime (APR)
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Portable Runtime (APR) security model
Apache Pulsar
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Pulsar security model

Q

Apache Qpid
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far

R

Apache Ranger
- Security contact:
  security@apache.org
- Advisories:
  cwiki.apache.org
- Security model:
  - Apache Ranger security model
Apache Ratis
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache RocketMQ
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache RocketMQ security model
Apache Roller
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Royale
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Rya
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far

S

Apache Samza
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Santuario
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Santuario security model
Apache SDAP
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Seata
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Seata security model
Apache SeaTunnel
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache SeaTunnel security model
Apache Sedona
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Serf
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache ServiceComb
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache ShardingSphere
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache ShardingSphere security model
Apache ShenYu
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache ShenYu security model
Apache Shiro
- Security contact:
  security@shiro.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Shiro security model
Apache SINGA
- Security contact:
  security@singa.apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache SINGA security model
Apache SIS
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache SkyWalking
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache SkyWalking security model
Apache Sling
- Security contact:
  security@sling.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Sling security model
Apache Solr
- Security contact:
  security@solr.apache.org
- Advisories:
  solr.apache.org
- Security model:
  - Apache Solr security model
Apache SpamAssassin
- Security contact:
  security@spamassassin.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache SpamAssassin security model
Apache Spark
- Security contact:
  security@apache.org
- Advisories:
  spark.apache.org
- Security model:
  - Apache Spark security model
Apache Steve
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Storm
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Storm security model
Apache StormCrawler
- Security contact:
  security@apache.org
- Advisories:
  stormcrawler.apache.org
- Security model:
  - Apache StormCrawler security model
Apache StreamPark
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache StreamPark security model
Apache StreamPipes
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache StreamPipes security model
Apache Struts
- Security contact:
  security@struts.apache.org
- Advisories:
  cwiki.apache.org
- Security model:
  - Apache Struts security model
Apache Subversion
- Security contact:
  security@subversion.apache.org
- Advisories:
  subversion.apache.org
- Security model:
  - Apache Subversion security model
Apache Superset
- Security contact:
  security@superset.apache.org
- Advisories:
  superset.apache.org
- Security model:
  - Apache Superset security model
Apache Synapse
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache Synapse security model
Apache Syncope
- Security contact:
  security@apache.org
- Advisories:
  syncope.apache.org
Apache SystemDS
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org

T

Apache Tapestry
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Tapestry security model
Apache Tcl
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Teaclave
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Tez
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Thrift
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Thrift security model
Apache Tika
- Security contact:
  security@apache.org
- Advisories:
  tika.apache.org
- Security model:
  - Apache Tika security model
Apache TinkerPop
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Tomcat
- Security contact:
  security@tomcat.apache.org
- Advisories:
  tomcat.apache.org
- Security model:
  - Apache Tomcat security model
Apache TomEE
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Traffic Server
- Security contact:
  security@trafficserver.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Traffic Server security model
Apache Training
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache TsFile
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Turbine
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache TVM
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
- Security model:
  - Apache TVM security model

U

Apache UIMA
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Uniffle
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Unomi
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Unomi security model

V

Apache VCL
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Velocity
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Velocity security model

W

Apache Wayang
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Web Services
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Whimsy
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache Wicket
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org

X

Apache Xalan
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache Xerces
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
Apache XML Graphics
- Security contact:
  security@apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache XML Graphics security model

Y

Apache Yetus
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far
Apache YuniKorn
- Security contact:
  security@apache.org
- Advisories (experimental):
  none so far

Z

Apache Zeppelin
- Security contact:
  security@zeppelin.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache Zeppelin security model
Apache ZooKeeper
- Security contact:
  security@zookeeper.apache.org
- Advisories (experimental):
  security.apache.org
- Security model:
  - Apache ZooKeeper security model