apache shiro

Name: apache shiro
Brand: apache

productUS

cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

10critical5high8medium1low

updated 2026-10-27

vulnerabilities (25)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2016-4437US	critical9.8OT critical	93.0% (100th)	KEV	1.2.5	2016-06-07	< 1.2.5
CVE-2020-17523US	critical9.8	85.9% (100th)	Exploit	1.7.1	2021-02-03	< 1.7.1
CVE-2010-3863US	medium5.0	54.5% (99th)	Exploit	no fix	2010-11-05	≤ 1.0.0
CVE-2020-13933US	high7.5	44.4% (99th)	Exploit	1.6.0	2020-08-17	< 1.6.0
CVE-2022-32532US	critical9.8OT high	25.5% (98th)	Exploit	1.9.1	2022-06-29	< 1.9.1
CVE-2020-11989US	critical9.8	24.4% (98th)	Exploit	1.5.3	2020-06-22	< 1.5.3
CVE-2019-12422US	high7.5	9.10% (95th)	Exploit	1.4.2	2019-11-18	< 1.4.2
CVE-2023-34478US	critical9.8	2.07% (81st)	Exploit	1.12.0	2023-07-24	2 versions
CVE-2026-49268US	critical9.1	0.51% (43rd)	Exploit	2.2.1	2026-06-17	2 versions
CVE-2021-41303US	critical9.8	76.1% (100th)	—	1.8.0	2021-09-17	< 1.8.0
CVE-2020-1957US	critical9.8	23.3% (98th)	—	1.5.2	2020-03-25	< 1.5.2
CVE-2016-6802US	high7.5	9.68% (95th)	—	no fix	2016-09-20	= 1.3.1
CVE-2020-17510US	critical9.8	8.03% (95th)	—	1.7.0	2020-11-05	< 1.7.0
CVE-2014-0074US	high7.5	5.49% (93rd)	—	no fix	2014-10-06	5 versions
CVE-2022-40664US	critical9.8	3.59% (89th)	—	1.10.0	2022-10-12	< 1.10.0
CVE-2023-22602US	high7.5	1.60% (76th)	—	1.11.0	2023-01-14	< 1.11.0
CVE-2023-46750US	medium6.1	1.50% (74th)	—	1.13.0	2023-12-14	2 versions
CVE-2023-46749US	medium6.5	1.19% (68th)	—	1.13.0	2024-01-15	2 versions
CVE-2026-58301US	medium6.5	0.47% (40th)	—	3.0.1	2026-08-31	2.0.0 → 3.0.1
CVE-2026-43827US	medium6.5	0.41% (35th)	—	2.1.1	2026-05-25	2 versions
CVE-2026-23903US	—	0.40% (34th)	—	2.0.7	2026-02-09	< 2.0.7
CVE-2026-44598US	medium5.4	0.37% (30th)	—	2.1.1	2026-05-25	2 versions
CVE-2026-48589US	medium5.4	0.35% (29th)	—	2.2.1	2026-05-25	2 versions
CVE-2026-43828US	medium6.5	0.27% (19th)	—	2.1.1	2026-05-25	2 versions
CVE-2026-23901US	low2.5	0.24% (16th)	—	2.0.7	2026-02-10	< 2.0.7

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-287Improper Authentication9 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')3 CVEs
CWE-284Improper Access Control2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-208Observable Timing Discrepancy1 CVEs
CWE-285Improper Authorization1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE25 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan