Login Request a demo
AS
Product
Apache Shiro
by Apache Software Foundation · last CVE Aug 31, 2026
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 2High 1Medium 4Low 1
Severity
All severities8Critical2High1Medium4Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Shiro to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-40664
9.8
4%
Oct 12
Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
Affected: Apache Shiro before 1.10.0
CVE-2026-49268
9.1
1%
Jun 17
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
Affected: through 2.2.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-56091
8.2
1%
Jun 25
Apache Shiro: Authentication bypass in Guice-Web integration
Affected: through 2.99.99; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-58301
6.5
0%
Aug 31
Apache Shiro: Server-side POST request may be steered to an alternate host
Affected: 2.0.0-alpha-0 through 3.0.0
CVE-2026-43828
6.5
0%
May 25
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
Affected: 1.0 through 2.1.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-43827
6.5
0%
May 25
Apache Shiro: Session fixation: new session is not created after login by default
Affected: 1.0 through 2.1.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-48589
5.4
0%
May 25
Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
Affected: 2.0.0-alpha-0 through 2.2.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-56130
2.0
0%
Jun 25
Apache Shiro: Remember-me cookie isn't checked for expiry on the server
Affected: 1.2.4 through 2.99.99; 3.0.0-alpha-0 through 3.0.0-alpha-1
Showing 8