AP
Product
APISIX
On CISA KEVExploited in the wild
29
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 14Medium 8Low 0
Watch
Add APISIX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: before 3.6.1 |
| CVE-2026-63041 | 8.8 | Aug 26 | Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers Affected: 3.11.0 before 3.18.0 |
| CVE-2026-39998 | 8.8 | Jun 19 | Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup Affected: 2.12.0 before 3.17.0 |
| CVE-2026-75020 | 8.1 | Aug 27 | Apache APISIX: ldap-auth plugin cross-subtree identity impersonation Affected: 2.11.0 before 3.18.0 |
| CVE-2026-49872 | 8.1 | Jun 19 | Apache APISIX: Improper authentication in cas-auth plugin Affected: 3.0.0 before 3.17.0 |
| CVE-2026-47339 | 8.1 | Jun 19 | Apache APISIX: authz-casdoor incorrect session sharing Affected: 2.14.1 before 3.17.0 |
| CVE-2025-27446 | 7.8 | Jul 6 | Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner) Affected: 0.2 through 0.5 |
| CVE-2026-74848 | 7.5 | Aug 27 | Apache APISIX: Cross-user response poisoning in serverless plugins Affected: 2.12.0 before 3.18.0 |
| CVE-2026-75005 | 7.5 | Aug 27 | Apache APISIX: Unauthenticated CPU-exhaustion DoS Affected: 3.17.0 |
| CVE-2026-31923 | 7.5 | Apr 14 | Apache APISIX: Openid-connect `tls_verify` field is disabled by default Affected: 0.7 before 3.16.0 |
| CVE-2025-62232 | 7.5 | Oct 31 | Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG Affected: 1.0 before 3.14.0 |
| CVE-2022-29266 | 7.5 | Apr 20 | In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt… Affected: before 2.13.1 |
| CVE-2021-43557 | 7.5 | Nov 22 | The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification Affected: before 2.10.2 |
| CVE-2026-48895 | 7.2 | Jun 19 | Apache APISIX: Cas-auth Host header influence on CAS service URL Affected: 3.0.0 before 3.17.0 |
Showing 14