AL
Product
Allura
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 2Medium 8Low 0
Watch
Add Allura to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-73239 | 6.5 | Aug 12 | Apache Allura: Missing permission checks IDOR Affected: before 1.19.1 |
| CVE-2026-73237 | 6.1 | Aug 12 | Apache Allura: XSS in markdown pipeline Affected: 1.10.0 before 1.19.1 |
| CVE-2026-73238 | 6.1 | Aug 12 | Apache Allura: XSS in code display Affected: before 1.19.1 |
| CVE-2019-10085 | 6.1 | Jun 19 | In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets Affected: before 1.11.0 |
| CVE-2018-1319 | 6.1 | Mar 15 | In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting Affected: through 1.8.0 |
| CVE-2026-75099 | 5.3 | Aug 24 | Apache Allura: Unauthenticated REST disclosure Affected: before 1.20.0 |
| CVE-2023-46851 | 4.9 | Nov 7 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments Affected: 1.0.1 before 1.16.0 |
| CVE-2024-38379 | 4.8 | Jun 22 | Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations… Affected: 1.4.0 before 1.17.1 |
Showing 8