Apache · product
Apache APISIX
41 CVEs · 1 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 1
- check available
- 1
- likely to be exploited
- 1
Every one of the 41 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache APISIX - Remote Code Execution
- Apache APISIX - Insufficiently Protected Credentials
- Path traversal in request_uri variable
- apisix/jwt-auth may leak secrets in error response
- Apache APISIX: the body_schema check in request-validation plugin can be bypassed
- Apache APISIX: Forward-Auth Request Smuggling
- Apache APISIX: Unauthenticated CPU-exhaustion DoS
- Apache APISIX: Session replay issue in hmac-auth
- Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
- Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup
- Apache APISIX: Cas-auth Host header influence on CAS service URL
- Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value
- Apache APISIX: JWT Algorithm Confusion allows authentication bypass
- Apache APISIX: Cross-user response poisoning in serverless plugins
- Apache APISIX: Identity spoofing issue in APISIX opa plugin
- Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
- Apache APISIX: forward auth plugin allows header injection
- Apache APISIX: Improper authentication in cas-auth plugin
- Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare
- Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header
- Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect
- Apache APISIX: basic-auth logs plaintext credentials at info level
- Apache APISIX: wolf-rbac plugin Identity Spoofing
- Apache APISIX: authz-casdoor incorrect session sharing
- Apache APISIX: identity spoofing in openapi-to-mcp
- Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.