SH
Product
Shiro
On CISA KEVExploited in the wild
25
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 4Medium 8Low 1
Watch
Add Shiro to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58301 | 6.5 | Aug 31 | Apache Shiro: Server-side POST request may be steered to an alternate host Affected: 2.0.0 before 3.0.1 |
| CVE-2026-43828 | 6.5 | May 25 | Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default Affected: before 2.1.1; 3.0.0 |
| CVE-2026-43827 | 6.5 | May 25 | Apache Shiro: Session fixation: new session is not created after login by default Affected: before 2.1.1; 3.0.0 |
| CVE-2023-46749 | 6.5 | Jan 15 | Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting … Affected: before 1.13.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2023-46750 | 6.1 | Dec 14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro Affected: before 1.13.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2026-48589 | 5.4 | May 25 | Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow Affected: 2.0.0 before 2.2.1; 3.0.0 |
| CVE-2026-44598 | 5.4 | May 25 | Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials) Affected: 2.0.0 before 2.1.1; 3.0.0 |
| CVE-2026-23903 | 5.3 | Feb 9 | Authentication Bypass by Alternate Name vulnerability in Apache Shiro Affected: before 2.0.7 |
Showing 8