AS
Product
Apache Shiro
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 7Low 2
Watch
Add Apache Shiro to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-23901 | 2.5 | Feb 10 | Apache Shiro: Brute force attack possible to determine valid user names Affected: before 2.0.7 |
| CVE-2026-56130 | 2.0 | Jun 25 | Apache Shiro: Remember-me cookie isn't checked for expiry on the server Affected: 1.2.4 through 2.99.99; 3.0.0-alpha-0 through 3.0.0-alpha-1 |
Showing 2