What’s Vulnerable › Products

Apache Software Foundation Apache Allura vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your Apache Software Foundation Apache Allura version is affected

Latest Apache Software Foundation Apache Allura vulnerabilities

• CVE-2026-92120 — Apache Allura: Oauth1 Replay Attack (CVSS 9.1)
• CVE-2026-92119 — Apache Allura: REST API Mass Assignment (CVSS 9.1)
• CVE-2026-92116 — Apache Allura: OAuth1 missing callback validation (CVSS 9.1)
• CVE-2026-80190 — Apache Allura: Stored XSS via code repositories (CVSS 6.1)
• CVE-2026-81270 — Apache Allura: Information exposure via search (CVSS 7.5)
• CVE-2026-80181 — Apache Allura: Server-side request forgery (CVSS 9.1)
• CVE-2026-80180 — Apache Allura: Stored XSS via markdown HTML processing (CVSS 6.1)
• CVE-2026-75099 — Apache Allura: Unauthenticated REST disclosure (CVSS 5.3)
• CVE-2026-73240 — Apache Allura: Git command injection (CVSS 9.8)
• CVE-2026-73239 — Apache Allura: Missing permission checks IDOR (CVSS 6.5)
• CVE-2026-73238 — Apache Allura: XSS in code display (CVSS 6.1)
• CVE-2026-73237 — Apache Allura: XSS in markdown pipeline (CVSS 6.1)
• CVE-2026-69223 — Apache Allura: Server-side request forgery (CVSS 9.1)
• CVE-2024-38379 — Apache Allura: Stored authenticated XSS (CVSS 4.8)
• CVE-2024-36471 — Apache Allura: sensitive information exposure via DNS rebinding (CVSS 7.5)
• CVE-2023-46851 — Apache Allura: sensitive information exposure via import (CVSS 4.9)
• CVE-2019-10085 — (CVSS 6.1)
• CVE-2018-1319 — (CVSS 6.1)
• CVE-2018-1299 — (CVSS 7.5)