Login Request a demo
AP
Product
APISIX
by Apache · last CVE Aug 27, 2026
On CISA KEVExploited in the wild
29
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities29In the news0Timeline
Severity mix
Critical 7High 14Medium 8Low 0
Severity
All severities29Critical7High14Medium8Low0
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add APISIX to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-47341
6.5
1%
Jun 19
Apache APISIX: Session replay issue in hmac-auth
Affected: 3.11.0 before 3.17.0
CVE-2020-13945
6.5
73%
Dec 7
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules
Affected: 1.2 through 1.5
CVE-2024-32638
6.3
1%
May 2
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from…
Affected: 3.8.0; 3.9.0
CVE-2026-44915
6.1
1%
Jun 19
Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value
Affected: 3.0.0 before 3.17.0
CVE-2026-44046
5.8
0%
Jun 19
Apache APISIX: wolf-rbac plugin Identity Spoofing
Affected: 1.2 before 3.17.0
CVE-2026-49231
5.4
1%
Jun 19
Apache APISIX: Identity spoofing issue in APISIX opa plugin
Affected: 3.5.0 before 3.17.0
CVE-2026-31924
5.3
0%
Apr 14
Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP
Affected: 2.99.0 before 3.16.0
CVE-2025-46647
5.3
0%
Jul 2
A vulnerability of plugin openid-connect in Apache APISIX
Affected: before 3.12.0
Showing 8