Login Request a demo
AS
Product
Apache Shiro
by Apache Software Foundation · last CVE Aug 31, 2026
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 2High 1Medium 5Low 2
Severity
All severities10Critical2High1Medium5Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Shiro to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-58301
6.5
0%
Aug 31
Apache Shiro: Server-side POST request may be steered to an alternate host
Affected: 2.0.0-alpha-0 through 3.0.0
CVE-2026-43828
6.5
0%
May 25
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
Affected: 1.0 through 2.1.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-43827
6.5
0%
May 25
Apache Shiro: Session fixation: new session is not created after login by default
Affected: 1.0 through 2.1.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-48589
5.4
0%
May 25
Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
Affected: 2.0.0-alpha-0 through 2.2.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-23903
5.3
0%
Feb 9
Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
Affected: before 2.0.7
Showing 5