SO
Product
Solr
On CISA KEVExploited in the wild
46
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 19Medium 10Low 1
Watch
Add Solr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44825 | 9.8 | Jun 1 | Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users Affected: 9.4.0 through 9.10.1; 10.0.0 |
| CVE-2024-45216 | 9.8 | Oct 16 | Improper Authentication vulnerability in Apache Solr Affected: 5.3.0 before 8.11.4; 9.0.0 before 9.7.0 |
| CVE-2021-44548 | 9.8 | Dec 23 | An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from… Affected: before 8.11.1 |
| CVE-2021-27905 | 9.8 | Apr 13 | The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate… Affected: before 8.8.2 |
| CVE-2020-13957 | 9.8 | Oct 13 | Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured… Affected: 6.6.0 through 6.6.6; 7.0.0 through 7.7.3; 8.0.0 through 8.6.2 |
| CVE-2019-12409 | 9.8 | Nov 18 | The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping… Affected: 8.1.1; 8.2.0 |
| CVE-2019-0192 | 9.8 | Mar 7 | In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request Affected: 5.0.0 through 5.5.5; 6.0.0 through 6.6.5 |
| CVE-2017-12629 | 9.8 | Oct 14 | Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the… Affected: 5.5.0 through 5.5.4; 6.0.0 through 6.6.1; 7.0.0 through 7.0.1 |
| CVE-2021-29943 | 9.1 | Apr 13 | When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead… Affected: before 8.8.2 |
| CVE-2017-1000190 | 9.1 | Nov 17 | SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on Affected: 8.4.1 |
Showing 10