Login Request a demo
AP
Product
APISIX
by Apache · last CVE Aug 27, 2026
On CISA KEVExploited in the wild
29
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities29In the news0Timeline
Severity mix
Critical 7High 14Medium 8Low 0
Severity
All severities29Critical7High14Medium8Low0
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add APISIX to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-24112
In wildKEV
9.8
96%
Feb 11
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
Affected: before 2.10.4; 2.11.0 before 2.12.1
CVE-2022-25757
9.8
2%
Mar 28
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result
Affected: before 2.13.0
CVE-2026-49871
9.3
0%
Jun 19
Apache APISIX: cas-auth login CSRF / session injection issue
Affected: 3.0.0 before 3.17.0
CVE-2026-49230
9.1
0%
Jun 19
Apache APISIX: Authentication bypass in jwe-decrypt
Affected: 3.8.0 before 3.17.0
CVE-2026-44087
9.1
0%
Jun 19
Apache APISIX: Openid-connect plugin Identity Header Spoofing
Affected: 2.3 before 3.17.0
CVE-2026-39999
9.1
1%
Jun 19
Apache APISIX: JWT Algorithm Confusion allows authentication bypass
Affected: 2.2 before 3.17.0
CVE-2026-31908
9.1
1%
Apr 14
Apache APISIX: forward auth plugin allows header injection
Affected: 2.12.0 before 3.16.0
Showing 7