Login Request a demo
AS
Product
Apache Shiro
by Apache Software Foundation · last CVE Aug 31, 2026
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 2High 1Medium 4Low 1
Severity
All severities8Critical2High1Medium4Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Shiro to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-58301
6.5
0%
Aug 31
Apache Shiro: Server-side POST request may be steered to an alternate host
Affected: 2.0.0-alpha-0 through 3.0.0
CVE-2026-43828
6.5
0%
May 25
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
Affected: 1.0 through 2.1.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-43827
6.5
0%
May 25
Apache Shiro: Session fixation: new session is not created after login by default
Affected: 1.0 through 2.1.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
CVE-2026-48589
5.4
0%
May 25
Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
Affected: 2.0.0-alpha-0 through 2.2.0; 3.0.0-alpha-0 through 3.0.0-alpha-1
Showing 4