agentprime: apache-software-foundation-apache-apisix

agentprime: apache-software-foundation-apache-apisixEvery new CVE for apache-software-foundation-apache-apisix.https://agentprime.io/CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issuehttps://agentprime.io/advisories/CVE-2026-94276/https://agentprime.io/advisories/CVE-2026-94276/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 11:02:36 GMTCVECVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatchhttps://agentprime.io/advisories/CVE-2026-94269/https://agentprime.io/advisories/CVE-2026-94269/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 11:02:20 GMTCVECVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memoryhttps://agentprime.io/advisories/CVE-2026-94250/https://agentprime.io/advisories/CVE-2026-94250/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 11:01:41 GMTCVECVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth pluginhttps://agentprime.io/advisories/CVE-2026-94220/https://agentprime.io/advisories/CVE-2026-94220/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 11:01:26 GMTCVECVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-authhttps://agentprime.io/advisories/CVE-2026-94212/https://agentprime.io/advisories/CVE-2026-94212/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 11:01:11 GMTCVECVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutationhttps://agentprime.io/advisories/CVE-2026-82806/https://agentprime.io/advisories/CVE-2026-82806/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 10:58:32 GMTCVECVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger outputhttps://agentprime.io/advisories/CVE-2026-78242/https://agentprime.io/advisories/CVE-2026-78242/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 10:58:13 GMTCVECVE-2026-74848: Apache APISIX: Cross-user response poisoning in serverless pluginshttps://agentprime.io/advisories/CVE-2026-74848/https://agentprime.io/advisories/CVE-2026-74848/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 09:16:06 GMTCVECVE-2026-75005: Apache APISIX: Unauthenticated CPU-exhaustion DoShttps://agentprime.io/advisories/CVE-2026-75005/https://agentprime.io/advisories/CVE-2026-75005/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 09:15:32 GMTCVECVE-2026-75020: Apache APISIX: ldap-auth plugin cross-subtree identity impersonationhttps://agentprime.io/advisories/CVE-2026-75020/https://agentprime.io/advisories/CVE-2026-75020/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 09:14:33 GMTCVECVE-2026-63041: Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headershttps://agentprime.io/advisories/CVE-2026-63041/https://agentprime.io/advisories/CVE-2026-63041/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 11:34:59 GMTCVECVE-2026-49872: Apache APISIX: Improper authentication in cas-auth pluginhttps://agentprime.io/advisories/CVE-2026-49872/https://agentprime.io/advisories/CVE-2026-49872/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:19:34 GMTCVECVE-2026-49871: Apache APISIX: cas-auth login CSRF / session injection issuehttps://agentprime.io/advisories/CVE-2026-49871/https://agentprime.io/advisories/CVE-2026-49871/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:18:36 GMTCVECVE-2026-47341: Apache APISIX: Session replay issue in hmac-authhttps://agentprime.io/advisories/CVE-2026-47341/https://agentprime.io/advisories/CVE-2026-47341/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:17:23 GMTCVECVE-2026-48895: Apache APISIX: Cas-auth Host header influence on CAS service URLhttps://agentprime.io/advisories/CVE-2026-48895/https://agentprime.io/advisories/CVE-2026-48895/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:16:29 GMTCVECVE-2026-49231: Apache APISIX: Identity spoofing issue in APISIX opa pluginhttps://agentprime.io/advisories/CVE-2026-49231/https://agentprime.io/advisories/CVE-2026-49231/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:14:52 GMTCVECVE-2026-49230: Apache APISIX: Authentication bypass in jwe-decrypthttps://agentprime.io/advisories/CVE-2026-49230/https://agentprime.io/advisories/CVE-2026-49230/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:13:38 GMTCVECVE-2026-44915: Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie valuehttps://agentprime.io/advisories/CVE-2026-44915/https://agentprime.io/advisories/CVE-2026-44915/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:12:33 GMTCVECVE-2026-44087: Apache APISIX: Openid-connect plugin Identity Header Spoofinghttps://agentprime.io/advisories/CVE-2026-44087/https://agentprime.io/advisories/CVE-2026-44087/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:11:17 GMTCVECVE-2026-47339: Apache APISIX: authz-casdoor incorrect session sharinghttps://agentprime.io/advisories/CVE-2026-47339/https://agentprime.io/advisories/CVE-2026-47339/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:10:04 GMTCVECVE-2026-44046: Apache APISIX: wolf-rbac plugin Identity Spoofinghttps://agentprime.io/advisories/CVE-2026-44046/https://agentprime.io/advisories/CVE-2026-44046/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:09:01 GMTCVECVE-2026-39999: Apache APISIX: JWT Algorithm Confusion allows authentication bypasshttps://agentprime.io/advisories/CVE-2026-39999/https://agentprime.io/advisories/CVE-2026-39999/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:07:50 GMTCVECVE-2026-39998: Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanuphttps://agentprime.io/advisories/CVE-2026-39998/https://agentprime.io/advisories/CVE-2026-39998/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 13:04:39 GMTCVECVE-2026-31923: Apache APISIX: Openid-connect `tls_verify` field is disabled by defaulthttps://agentprime.io/advisories/CVE-2026-31923/https://agentprime.io/advisories/CVE-2026-31923/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 08:38:59 GMTCVECVE-2026-31924: Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTPhttps://agentprime.io/advisories/CVE-2026-31924/https://agentprime.io/advisories/CVE-2026-31924/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 08:08:05 GMTCVECVE-2026-31908: Apache APISIX: forward auth plugin allows header injectionhttps://agentprime.io/advisories/CVE-2026-31908/https://agentprime.io/advisories/CVE-2026-31908/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 08:06:18 GMTCVEcriticalCVE-2025-62232: Apache APISIX: basic-auth logs plaintext credentials at info levelhttps://agentprime.io/advisories/CVE-2025-62232/https://agentprime.io/advisories/CVE-2025-62232/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Oct 2025 08:48:23 GMTCVECVE-2025-46647: Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connecthttps://agentprime.io/advisories/CVE-2025-46647/https://agentprime.io/advisories/CVE-2025-46647/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Jul 2025 11:08:47 GMTCVECVE-2024-32638: Apache APISIX: Forward-Auth Request Smugglinghttps://agentprime.io/advisories/CVE-2024-32638/https://agentprime.io/advisories/CVE-2024-32638/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 May 2024 09:20:29 GMTCVECVE-2022-29266: apisix/jwt-auth may leak secrets in error responsehttps://agentprime.io/advisories/CVE-2022-29266/https://agentprime.io/advisories/CVE-2022-29266/Published by the CVE Program. Not analysed by agentprime yet.Wed, 20 Apr 2022 07:15:13 GMTCVECVE-2022-25757: Apache APISIX: the body_schema check in request-validation plugin can be bypassedhttps://agentprime.io/advisories/CVE-2022-25757/https://agentprime.io/advisories/CVE-2022-25757/Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Mar 2022 07:00:16 GMTCVECVE-2022-24112: apisix/batch-requests plugin allows overwriting the X-REAL-IP headerhttps://agentprime.io/advisories/CVE-2022-24112/https://agentprime.io/advisories/CVE-2022-24112/CVSS 9.8 (Critical). Critical: In CISA’s KEV catalogue since 25 Aug 2022: it is known to be exploited. CVSS score 9.8: 9.0 or more. CVSS score 9.8 (7.0 or more) and EPSS 0.96 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Feb 2022 12:20:13 GMTCVEcriticalKEVCVE-2021-43557: Path traversal in request_uri variablehttps://agentprime.io/advisories/CVE-2021-43557/https://agentprime.io/advisories/CVE-2021-43557/Published by the CVE Program. Not analysed by agentprime yet.Mon, 22 Nov 2021 08:25:09 GMTCVECVE-2020-13945: Apache Software Foundation Apache APISIX: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP…https://agentprime.io/advisories/CVE-2020-13945/https://agentprime.io/advisories/CVE-2020-13945/Published by the CVE Program. Not analysed by agentprime yet.Mon, 07 Dec 2020 19:04:52 GMTCVE