How many Apache Software Foundation fineract CVEs are in CISA KEV?

None of Apache Software Foundation fineract's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Apache Software Foundation fineract are affected?

51 distinct Apache Software Foundation fineract versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation fineract CVEs?

Apache Software Foundation fineract's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-269 (Improper Privilege Management), CWE-521 (Weak Password Requirements), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

What is the average severity of Apache Software Foundation fineract CVEs?

The average CVSS base score across Apache Software Foundation fineract's scored CVEs is 8.4.

Apache Software Foundation

23 CVEs

Apache Software Foundation fineract Vulnerabilities

Name: Apache Software Foundation fineract vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for fineract by Apache Software Foundation.

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

8.4

Avg CVSS

2017–2026

Last updated July 15, 2026

Overview

Apache Software Foundation fineract has 23 published CVE records since 2017, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 8.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation fineract, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Apache Software Foundation fineract's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical7

High14

Medium2

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of Apache Software Foundation fineract's CVEs are currently listed in CISA's KEV catalog.

Public exploits

No Apache Software Foundation fineract CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every Apache Software Foundation fineract version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

1.0.018 CVEs
1.1.014 CVEs
1.2.014 CVEs
1.3.012 CVEs
1.5.010 CVEs
1.10.06 CVEs
1.9.06 CVEs
1.11.05 CVEs
1.12.05 CVEs
1.12.13 CVEs
1.14.03 CVEs
1.8.01 CVE

Version ranges

0.4.0 <= v <= 0.4.05 CVEs
0.5.0 <= v <= 0.5.05 CVEs
0.6.0 <= v <= 0.6.05 CVEs
<= 0.4.04 CVEs
<= 0.5.04 CVEs
<= 0.6.04 CVEs
1.0.0 <= v <= 1.0.04 CVEs
< 1.15.03 CVEs
< 1.9.03 CVEs
< 1.12.12 CVEs
< 1.3.02 CVEs
1.4.0 <= v <= 1.8.22 CVEs
< 1.11.01 CVE
< 1.5.01 CVE
< 1.8.11 CVE
< 1.8.51 CVE
<= 0.4.0-incubating1 CVE
<= 0.5.0-incubating1 CVE
<= 0.6.0-incubating1 CVE
1.0.0 <= v <= 1.3.01 CVE
1.4.0 <= v < 1.10.11 CVE
1.4.0 <= v <= 1.8.31 CVE

Fixed in

1.15.03 CVEs
1.9.03 CVEs
5d96e8cc32ff63f97d5ac15e19c6fafee0c313573 CVEs
1.12.12 CVEs
1.3.02 CVEs
210e380df3ca5c74c8c2fa09e7fe1cffdb87e20a2 CVEs
c84ba089f0f2f04aff8ca14d930e3328dc78a2ce2 CVEs
> 1.8.31 CVE
1.10.11 CVE
1.11.01 CVE
1.5.01 CVE
1.8.11 CVE
1.8.51 CVE
227bdf6e4f0d271e19193fe6f9d59f36720a772a1 CVE
843b27926e516420297f40655fa734277195d7731 CVE
90f854b68886458a466b048807c26ccf31a6f5551 CVE
f87b66d4e1beb244bb77b7f084b64e72fd3f697c1 CVE

Find a version

23 CVEs

Sort

Apache Fineract: Office list: SQL Injection via Subquery in orderBy
CVE-2026-57821
Patch
CWE-89
High · CVSS 8.1
EPSS 0.8% (54th pct)2026-07-15
Apache Fineract: SQL injection in runreports endpoint
CVE-2026-35152
Patch
CWE-89
High · CVSS 8.8
EPSS 2.3% (81th pct)2026-07-15
Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure
CVE-2026-56287
Patch
CWE-89
High · CVSS 8.1
EPSS 0.5% (38th pct)2026-07-15
Apache Fineract: IDOR via self-service API
CVE-2025-58137
Patch
CWE-639
High · CVSS 8.1
EPSS 0.3% (26th pct)2025-12-12
Apache Fineract: Server Key not masked
CVE-2025-58130
Patch
CWE-522
Critical · CVSS 9.1
EPSS 0.4% (30th pct)2025-12-12
Apache Fineract: weak password policy
CVE-2025-23408
Patch
CWE-521
High · CVSS 8.5
EPSS 0.4% (37th pct)2025-12-12
Critical vulnerability · 2025-02-12
CVE-2024-32838
Patch
CWE-89
Critical · CVSS 9.4
EPSS 1.5% (71th pct)2025-02-12
High vulnerability · 2024-03-29
CVE-2024-23537
Patch
CWE-269
High · CVSS 8.8
EPSS 1.1% (62th pct)2024-03-29
Critical vulnerability · 2024-03-29
CVE-2024-23538
Patch
CWE-89
Critical · CVSS 9.9
EPSS 1.3% (67th pct)2024-03-29
Critical vulnerability · 2024-03-29
CVE-2024-23539
Patch
CWE-89
Critical · CVSS 9.8
EPSS 1.5% (71th pct)2024-03-29
apache fineract: SQL injection vulnerability in certain procedure calls
CVE-2023-25197
Patch
CWE-89
Medium · CVSS 6.3
EPSS 1.1% (61th pct)2023-03-28
Medium vulnerability · 2023-03-28
CVE-2023-25196
Patch
CWE-89
Medium · CVSS 4.3
EPSS 1.3% (67th pct)2023-03-28
Apache Fineract: SSRF template type vulnerability in certain authenticated users
CVE-2023-25195
Patch
CWE-918
High · CVSS 8.1
EPSS 1.0% (59th pct)2023-03-28
High vulnerability · 2022-11-29
CVE-2022-44635
Patch
CWE-22
High · CVSS 8.8
EPSS 68.8% (99th pct)2022-11-29
High vulnerability · 2021-05-27
CVE-2020-17514
Patch
High · CVSS 7.4
EPSS 3.4% (88th pct)2021-05-27
High vulnerability · 2020-10-13
CVE-2018-20243
High · CVSS 7.5
EPSS 2.7% (84th pct)2020-10-13
Critical vulnerability · 2019-06-11
CVE-2018-11801
Patch
Critical · CVSS 9.8
EPSS 5.2% (92th pct)2019-06-11
Critical vulnerability · 2019-06-11
CVE-2018-11800
Patch
Critical · CVSS 9.8
EPSS 5.2% (92th pct)2019-06-11
High vulnerability · 2018-04-20
CVE-2018-1292
High · CVSS 8.1
EPSS 2.2% (80th pct)2018-04-20
High vulnerability · 2018-04-20
CVE-2018-1291
High · CVSS 8.1
EPSS 2.1% (80th pct)2018-04-20
Critical vulnerability · 2018-04-20
CVE-2018-1290
Critical · CVSS 9.8
EPSS 3.4% (88th pct)2018-04-20
High vulnerability · 2018-04-20
CVE-2018-1289
High · CVSS 8.8
EPSS 2.7% (84th pct)2018-04-20
High vulnerability · 2017-12-14
CVE-2017-5663
High · CVSS 8.8
EPSS 2.1% (80th pct)2017-12-14

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation fineract CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Apache Software Foundation fineract CVEs were published each year.

2017

2018

2019

2020

2021

2022

2023

2024

2025

2026

Other Apache Software Foundation products

Browse vulnerabilities for other products by Apache Software Foundation.

http server351 CVEs tomcat265 CVEs airflow183 CVEs Apache Airflow136 CVEs apache-airflow127 CVEs Apache HTTP Server125 CVEs httpd125 CVEs org.apache.tomcat:tomcat118 CVEs

All Apache Software Foundation vulnerabilities

Frequently asked questions

Common questions about Apache Software Foundation fineract vulnerabilities.

How many CVEs does Apache Software Foundation fineract have?: Apache Software Foundation fineract has 23 published CVE records since 2017.
How many Apache Software Foundation fineract CVEs are in CISA KEV?: None of Apache Software Foundation fineract's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Apache Software Foundation fineract vulnerabilities?: No Apache Software Foundation fineract CVEs currently have a tracked public exploit in this dataset.
Which versions of Apache Software Foundation fineract are affected?: 51 distinct Apache Software Foundation fineract versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Apache Software Foundation fineract CVEs?: Apache Software Foundation fineract's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-269 (Improper Privilege Management), CWE-521 (Weak Password Requirements), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
How many critical Apache Software Foundation fineract vulnerabilities are there?: Apache Software Foundation fineract has 7 critical and 14 high-severity CVEs.
What is the average severity of Apache Software Foundation fineract CVEs?: The average CVSS base score across Apache Software Foundation fineract's scored CVEs is 8.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation fineract vulnerabilities

Monitor new Apache Software Foundation fineract vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing