apache apisix

Name: apache apisix
Brand: apache

productUS

cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

6critical11high5medium0low

updated 2026-10-27

vulnerabilities (29)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-44487US	high7.5OT critical	100.0% (100th)	KEV	3.6.1	2023-10-10	< 3.6.1
CVE-2022-24112US	critical9.8OT critical	96.1% (100th)	KEV	2.12.1	2022-02-11	2 versions
CVE-2020-13945US	medium6.5	73.0% (99th)	Exploit	no fix	2020-12-07	1.2 → 1.5
CVE-2021-43557US	high7.5	13.0% (96th)	Exploit	2.10.2	2021-11-22	< 2.10.2
CVE-2026-31908US	—	0.52% (44th)	Exploit	3.16.0	2026-04-14	2.12.0 → 3.16.0
CVE-2026-49230US	critical9.1	0.30% (22nd)	Exploit	3.17.0	2026-06-19	3.8.0 → 3.17.0
CVE-2022-29266US	high7.5	8.14% (95th)	—	2.13.1	2022-04-20	< 2.13.1
CVE-2022-25757US	critical9.8	2.48% (84th)	—	2.13.0	2022-03-28	< 2.13.0
CVE-2024-32638US	—	1.06% (65th)	—	no fix	2024-05-02	2 versions
CVE-2026-75005US	high7.5	0.74% (54th)	—	no fix	2026-08-27	= 3.17.0
CVE-2026-47341US	medium6.5OT elevated	0.69% (53rd)	—	3.17.0	2026-06-19	3.11.0 → 3.17.0
CVE-2026-63041US	high8.8	0.68% (52nd)	—	3.18.0	2026-08-26	3.11.0 → 3.18.0
CVE-2026-39998US	high8.8	0.68% (52nd)	—	3.17.0	2026-06-19	2.12.0 → 3.17.0
CVE-2026-48895US	high7.2	0.65% (51st)	—	3.17.0	2026-06-19	3.0.0 → 3.17.0
CVE-2026-44915US	medium6.1	0.64% (51st)	—	3.17.0	2026-06-19	3.0.0 → 3.17.0
CVE-2026-39999US	critical9.1	0.64% (50th)	—	3.17.0	2026-06-19	2.2 → 3.17.0
CVE-2026-74848US	high7.5	0.59% (48th)	—	3.18.0	2026-08-27	2.12.0 → 3.18.0
CVE-2026-49231US	medium5.4	0.57% (47th)	—	3.17.0	2026-06-19	3.5.0 → 3.17.0
CVE-2026-75020US	high8.1	0.55% (46th)	—	3.18.0	2026-08-27	2.11.0 → 3.18.0
CVE-2026-49872US	high8.1	0.53% (44th)	—	3.17.0	2026-06-19	3.0.0 → 3.17.0
CVE-2025-46647US	—	0.48% (41st)	—	3.12.0	2025-07-02	< 3.12.0
CVE-2025-62232US	—	0.48% (41st)	—	3.14.0	2025-10-31	1.0 → 3.14.0
CVE-2026-44046US	medium5.8	0.47% (41st)	—	3.17.0	2026-06-19	1.2 → 3.17.0
CVE-2026-47339US	high8.1OT elevated	0.47% (41st)	—	3.17.0	2026-06-19	2.14.1 → 3.17.0
CVE-2026-49871US	critical9.3	0.35% (29th)	—	3.17.0	2026-06-19	3.0.0 → 3.17.0
CVE-2026-44087US	critical9.1OT elevated	0.28% (21st)	—	3.17.0	2026-06-19	2.3 → 3.17.0
CVE-2026-31923US	—OT elevated	0.25% (16th)	—	3.16.0	2026-04-14	0.7 → 3.16.0
CVE-2026-31924US	—OT elevated	0.24% (15th)	—	3.16.0	2026-04-14	2.99.0 → 3.16.0
CVE-2025-27446US	—	0.21% (11th)	—	no fix	2025-07-06	0.2 → 0.5

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-290Authentication Bypass by Spoofing3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-287Improper Authentication2 CVEs
CWE-319Cleartext Transmission of Sensitive Information2 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')2 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')2 CVEs
CWE-209Generation of Error Message Containing Sensitive Information1 CVEs
CWE-294Authentication Bypass by Capture-replay1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE29 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan