| CVE-2026-31908 |
Header injection vulnerability in Apache APISIX
|
Not rated
|
Apr 14, 2026 |
| CVE-2025-62232 |
Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and…
|
Not rated
|
Oct 31, 2025 |
| CVE-2025-46647 |
A vulnerability of plugin openid-connect in Apache APISIX
|
Not rated
|
Jul 2, 2025 |
| CVE-2024-32638 |
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using…
|
Not rated
|
May 2, 2024 |
| CVE-2022-29266 |
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the…
|
Not rated
|
Apr 20, 2022 |
| CVE-2022-25757 |
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as…
|
Not rated
|
Mar 28, 2022 |
| CVE-2022-24112 |
Exploited
Apache APISIX Authentication Bypass Vulnerability
|
Not rated
|
Feb 11, 2022 |
| CVE-2021-43557 |
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification
|
Not rated
|
Nov 22, 2021 |
| CVE-2020-13945 |
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules
|
Not rated
|
Dec 7, 2020 |