Advisories · Technology

Apache Software Foundation Apache Allura.

Every CVE that names Apache Software Foundation Apache Allura among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-92120 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Allura: Oauth1 Replay Attack
- Apache Software Foundation Apache Allura
- Authentication bypass
Not analysed yet 12 Oct 2026
CVE-2026-92119 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Allura: REST API Mass Assignment
- Apache Software Foundation Apache Allura
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-92116 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Allura: OAuth1 missing callback validation
- Apache Software Foundation Apache Allura
- Open redirect
Not analysed yet 12 Oct 2026
CVE-2026-80190 CVE record

CVSS 6.1 Medium

Apache Allura: Stored XSS via code repositories
- Apache Software Foundation Apache Allura
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-81270 CVE record

CVSS 7.5 High

Apache Allura: Information exposure via search
- Apache Software Foundation Apache Allura
- Information disclosure
Not analysed yet 4 Sept 2026
CVE-2026-80181 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Allura: Server-side request forgery
- Apache Software Foundation Apache Allura
- Server-side request forgery (SSRF)
Not analysed yet 4 Sept 2026
CVE-2026-80180 CVE record

CVSS 6.1 Medium

Apache Allura: Stored XSS via markdown HTML processing
- Apache Software Foundation Apache Allura
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-75099 CVE record

CVSS 5.3 Medium

Apache Allura: Unauthenticated REST disclosure
- Apache Software Foundation Apache Allura
- Information disclosure
Not analysed yet 24 Aug 2026
CVE-2026-73237 CVE record

CVSS 6.1 Medium

Apache Allura: XSS in markdown pipeline
- Apache Software Foundation Apache Allura
- Cross-site scripting (XSS)
Not analysed yet 12 Aug 2026
CVE-2026-73238 CVE record

CVSS 6.1 Medium

Apache Allura: XSS in code display
- Apache Software Foundation Apache Allura
- Cross-site scripting (XSS)
Not analysed yet 12 Aug 2026
CVE-2026-73239 CVE record

CVSS 6.5 Medium

Apache Allura: Missing permission checks IDOR
- Apache Software Foundation Apache Allura
- Broken access control
- CWE-280
Not analysed yet 12 Aug 2026
CVE-2026-73240 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Allura: Git command injection
- Apache Software Foundation Apache Allura
- Command injection
Not analysed yet 12 Aug 2026
CVE-2026-69223 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Allura: Server-side request forgery
- Apache Software Foundation Apache Allura
- Server-side request forgery (SSRF)
Not analysed yet 11 Aug 2026
CVE-2024-38379 CVE record

CVSS 4.8 Medium

Apache Allura: Stored authenticated XSS
- Apache Software Foundation Apache Allura
- Cross-site scripting (XSS)
Not analysed yet 22 Jun 2024
CVE-2024-36471 CVE record

CVSS 7.5 High

Apache Allura: sensitive information exposure via DNS rebinding
- Apache Software Foundation Apache Allura
- Information disclosure
- Server-side request forgery (SSRF)
Not analysed yet 10 Jun 2024
CVE-2023-46851 CVE record

Apache Allura: sensitive information exposure via import
- Apache Software Foundation Apache Allura
- Path traversal
- Information disclosure
Not analysed yet 7 Nov 2023
CVE-2018-1319 CVE record

In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting.
- Apache Software Foundation Apache Allura
Not analysed yet 15 Mar 2018
CVE-2018-1299 CVE record

Apache Software Foundation Apache Allura: In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files…
- Apache Software Foundation Apache Allura
Not analysed yet 6 Feb 2018