CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,500 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,500
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product apache:apisix. Show all products

22 CVEs, showing 1 to 22
CVESeverityTitlePublished
CVE-2022-24112
Known exploited
Critical 9.8apisix/batch-requests plugin allows overwriting the X-REAL-IP header
Assigned by apache
Feb 11, 2022
CVE-2023-44487
Known exploited
High 7.5The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Assigned by mitre
Oct 10, 2023
CVE-2025-62232High 7.5Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG.Oct 31, 2025
CVE-2026-31908Critical 9.1Header injection vulnerability in Apache APISIX.Apr 14, 2026
CVE-2026-31923High 7.5Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.Apr 14, 2026
CVE-2026-31924Medium 5.3Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.Apr 14, 2026
CVE-2026-39998High 8.8Improper Input Validation vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-39999Critical 9.1Authentication Bypass by Spoofing vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-44046Medium 5.8Use of Less Trusted Source vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-44087Critical 9.1Insufficient Verification of Data Authenticity vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-44915Medium 6.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-47339High 8.1Incorrect Authorization vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-47341Medium 6.5Authentication Bypass by Capture-replay vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-48895High 7.2URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-49230Critical 9.1Improper Validation of Integrity Check Value vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-49231Medium 5.4Authentication Bypass by Spoofing vulnerability in opa plugin.Jun 19, 2026
CVE-2026-49871Critical 9.3Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations.Jun 19, 2026
CVE-2026-49872High 8.1Improper Authentication vulnerability in Apache APISIX.Jun 19, 2026
CVE-2026-63041Medium 5.3Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
Assigned by apache
Aug 26, 2026
CVE-2026-75020High 7.0Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
Assigned by apache
Aug 27, 2026
CVE-2026-75005High 8.7Apache APISIX: Unauthenticated CPU-exhaustion DoS
Assigned by apache
Aug 27, 2026
CVE-2026-74848High 7.0Apache APISIX: Cross-user response poisoning in serverless plugins
Assigned by apache
Aug 27, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.