AA
Product
Apache APISIX
On CISA KEVExploited in the wild
27
CVEs
1
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 6High 10Medium 10Low 1
Watch
Add Apache APISIX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-24112 In wildKEV | 9.8 | Feb 11 | apisix/batch-requests plugin allows overwriting the X-REAL-IP header Affected: Apache APISIX 2.12 before 2.12.1; Apache APISIX 2.10 before 2.10.4; 1.3 before Apache APISIX 1* |
| CVE-2026-49871 | 9.3 | Jun 19 | Apache APISIX: cas-auth login CSRF / session injection issue Affected: 3.0.0 through 3.16.0 |
| CVE-2026-49230 | 9.1 | Jun 19 | Apache APISIX: Authentication bypass in jwe-decrypt Affected: 3.8.0 through 3.16.0 |
| CVE-2026-44087 | 9.1 | Jun 19 | Apache APISIX: Openid-connect plugin Identity Header Spoofing Affected: 2.3 through 3.16.0 |
| CVE-2026-39999 | 9.1 | Jun 19 | Apache APISIX: JWT Algorithm Confusion allows authentication bypass Affected: 2.2 through 3.16.0 |
| CVE-2026-31908 | 9.1 | Apr 14 | Apache APISIX: forward auth plugin allows header injection Affected: 2.12.0 through 3.15.0 |
Showing 6