AA
Product
Apache APISIX
On CISA KEVExploited in the wild
27
CVEs
1
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 6High 10Medium 10Low 1
Watch
Add Apache APISIX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47341 | 6.5 | Jun 19 | Apache APISIX: Session replay issue in hmac-auth Affected: 3.11.0 through 3.16.0 |
| CVE-2026-94212 | 6.4 | Oct 1 | Apache APISIX: unauthenticated impersonation issue in saml-auth Affected: 3.17.0 through 3.18.0 |
| CVE-2026-94269 | 6.3 | Oct 1 | Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch Affected: 2.14.1 through 3.18.0 |
| CVE-2026-44915 | 6.1 | Jun 19 | Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value Affected: 3.0.0 through 3.16.0 |
| CVE-2026-44046 | 5.8 | Jun 19 | Apache APISIX: wolf-rbac plugin Identity Spoofing Affected: 1.2.0 through 3.16.0 |
| CVE-2026-78242 | 5.7 | Oct 1 | Apache APISIX: data-mask may fail to redact request headers in logger output Affected: 3.17.0 |
| CVE-2026-49231 | 5.4 | Jun 19 | Apache APISIX: Identity spoofing issue in APISIX opa plugin Affected: 3.5.0 through 3.16.0 |
| CVE-2026-82806 | 5.3 | Oct 1 | Apache APISIX: cross-request permission pollution via static permission list mutation Affected: 2.3.0 before 3.7.0 |
| CVE-2026-31924 | 5.3 | Apr 14 | Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP Affected: 2.99.0 through 3.15.0 |
| CVE-2026-94276 | 5.1 | Oct 1 | Apache APISIX: Openid-connect introspection validation issue Affected: 3.12.0 through 3.18.0 |
Showing 10