AS
Product
Apache Shiro
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 5Low 2
Watch
Add Apache Shiro to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-40664 | 9.8 | Oct 12 | Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher Affected: Apache Shiro before 1.10.0 |
| CVE-2026-49268 | 9.1 | Jun 17 | Apache Shiro: LDAP DN Injection in DefaultLdapRealm Affected: through 2.2.0; 3.0.0-alpha-0 through 3.0.0-alpha-1 |
| CVE-2026-56091 | 8.2 | Jun 25 | Apache Shiro: Authentication bypass in Guice-Web integration Affected: through 2.99.99; 3.0.0-alpha-0 through 3.0.0-alpha-1 |
| CVE-2026-58301 | 6.5 | Aug 31 | Apache Shiro: Server-side POST request may be steered to an alternate host Affected: 2.0.0-alpha-0 through 3.0.0 |
| CVE-2026-43828 | 6.5 | May 25 | Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default Affected: 1.0 through 2.1.0; 3.0.0-alpha-0 through 3.0.0-alpha-1 |
| CVE-2026-43827 | 6.5 | May 25 | Apache Shiro: Session fixation: new session is not created after login by default Affected: 1.0 through 2.1.0; 3.0.0-alpha-0 through 3.0.0-alpha-1 |
| CVE-2026-48589 | 5.4 | May 25 | Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow Affected: 2.0.0-alpha-0 through 2.2.0; 3.0.0-alpha-0 through 3.0.0-alpha-1 |
| CVE-2026-23903 | 5.3 | Feb 9 | Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems Affected: before 2.0.7 |
| CVE-2026-23901 | 2.5 | Feb 10 | Apache Shiro: Brute force attack possible to determine valid user names Affected: before 2.0.7 |
| CVE-2026-56130 | 2.0 | Jun 25 | Apache Shiro: Remember-me cookie isn't checked for expiry on the server Affected: 1.2.4 through 2.99.99; 3.0.0-alpha-0 through 3.0.0-alpha-1 |
Showing 10