Login Request a demo
AA
Product
Apache Allura
by Apache Software Foundation · last CVE Oct 12, 2026
13
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 6High 1Medium 6Low 0
Severity
All severities13Critical6High1Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Allura to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-73240
9.8
1%
Aug 12
Apache Allura: Git command injection
Affected: before 1.19.1
CVE-2026-92120
9.1
0%
Oct 12
Apache Allura: Oauth1 Replay Attack
Affected: through 1.21.0
CVE-2026-92119
9.1
0%
Oct 12
Apache Allura: REST API Mass Assignment
Affected: through 1.21.0
CVE-2026-92116
9.1
0%
Oct 12
Apache Allura: OAuth1 missing callback validation
Affected: through 1.21.0
CVE-2026-80181
9.1
0%
Sep 4
Apache Allura: Server-side request forgery
Affected: through 1.20.0
CVE-2026-69223
9.1
1%
Aug 11
Apache Allura: Server-side request forgery
Affected: before 1.19.1
CVE-2026-81270
7.5
0%
Sep 4
Apache Allura: Information exposure via search
Affected: through 1.20.0
CVE-2026-73239
6.5
1%
Aug 12
Apache Allura: Missing permission checks IDOR
Affected: before 1.19.1
CVE-2026-80190
6.1
0%
Sep 4
Apache Allura: Stored XSS via code repositories
Affected: through 1.20.0
CVE-2026-80180
6.1
0%
Sep 4
Apache Allura: Stored XSS via markdown HTML processing
Affected: through 1.20.0
CVE-2026-73237
6.1
1%
Aug 12
Apache Allura: XSS in markdown pipeline
Affected: 1.10.0 before 1.19.1
CVE-2026-73238
6.1
1%
Aug 12
Apache Allura: XSS in code display
Affected: before 1.19.1
CVE-2026-75099
5.3
1%
Aug 24
Apache Allura: Unauthenticated REST disclosure
Affected: through 1.19.1
Showing 13