How many Apache Software Foundation shiro CVEs are in CISA KEV?

Yes — 1 of Apache Software Foundation shiro's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of Apache Software Foundation shiro are affected?

94 distinct Apache Software Foundation shiro versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation shiro CVEs?

Apache Software Foundation shiro's CVEs most often map to these CWE weakness types: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-287 (Improper Authentication), CWE-384 (Session Fixation).

How many critical Apache Software Foundation shiro vulnerabilities are there?

Apache Software Foundation shiro has 9 critical and 6 high-severity CVEs.

What is the average severity of Apache Software Foundation shiro CVEs?

The average CVSS base score across Apache Software Foundation shiro's scored CVEs is 7.3.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Apache Software Foundation

24 CVEs

1 in CISA KEV

Apache Software Foundation shiro Vulnerabilities

Name: Apache Software Foundation shiro vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for shiro by Apache Software Foundation.

24

Total CVEs

Published

1

In CISA KEV

Exploited in the wild

4

Public exploits

PoC or exploit code

7.3

Avg CVSS

2010–2026

Last updated June 17, 2026

Overview

Apache Software Foundation shiro has 24 published CVE records since 2010, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 4 have a known public exploit. The average CVSS base score across scored CVEs is 7.3.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation shiro, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Apache Software Foundation shiro's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical9

High6

Medium7

Low1

1 additional CVE has no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

1

One of Apache Software Foundation shiro's CVEs is confirmed exploited in the wild.

Public exploits

4

4 of Apache Software Foundation shiro's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Apache Software Foundation shiro version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

shiro-root-1.4.0-RC213 CVEs
shiro-root-1.4.0-RC2-release-vote113 CVEs
shiro-root-1.4.113 CVEs
shiro-root-1.5.012 CVEs
shiro-root-1.5.211 CVEs
shiro-root-1.5.2-release-vote111 CVEs
shiro-root-1.5.310 CVEs
shiro-root-1.5.3-release-vote110 CVEs
shiro-root-1.6.09 CVEs
shiro-root-1.7.08 CVEs
shiro-root-1.7.17 CVEs
shiro-root-1.8.06 CVEs
shiro-root-1.9.06 CVEs
shiro-root-1.9.0-release-vote16 CVEs
shiro-root-1.9.15 CVEs
shiro-root-1.10.04 CVEs
shiro-root-1.10.0-vote-14 CVEs
shiro-root-1.11.03 CVEs
shiro-root-1.13.0-vote-12 CVEs
1.0.0.RC31 CVE
1.0.0.RC41 CVE
2.0.0alpha11 CVE
2.0.0alpha21 CVE
2.6.01 CVE
shiro-root-1.2.51 CVE
shiro-root-1.2.61 CVE
shiro-root-1.2.6-release-vote11 CVE
shiro-root-1.3.01 CVE
shiro-root-1.3.0-release-vote11 CVE
shiro-root-1.3.11 CVE
shiro-root-1.3.1-release-vote11 CVE

Version ranges

3.0.0 <= v <= 3.0.05 CVEs
<= 2.0.0-alpha13 CVEs
<= 2.0.0-alpha23 CVEs
2.0.0 <= v <= 2.0.03 CVEs
< 1.13.02 CVEs
< 2.0.72 CVEs
< 2.1.12 CVEs
<= 2.0.0-alpha32 CVEs
<= 9.02 CVEs
< 1.10.01 CVE
< 1.11.01 CVE
< 1.12.01 CVE
< 1.2.51 CVE
< 1.4.21 CVE

Fixed in

2.1.13 CVEs
1.13.02 CVEs
2.0.72 CVEs
2.2.12 CVEs
86819589b3fe4442f4ec1b1cf34e6113afbba73b2 CVEs
1.10.01 CVE
1.11.01 CVE
1.12.01 CVE
1.2.51 CVE
1.4.21 CVE
1.5.21 CVE
1.5.31 CVE
1.6.01 CVE
1.7.01 CVE

Find a version

24 CVEs

Sort

Apache Shiro: LDAP DN Injection in DefaultLdapRealm
CVE-2026-49268
Patch
CWE-90
High · CVSS 8.8
EPSS 0.5% (39th pct)2026-06-17
Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
CVE-2026-48589
Patch
CWE-601
CVSS 0.0
EPSS 0.4% (27th pct)2026-05-25
Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)
CVE-2026-44598
Patch
CWE-601
Medium · CVSS 5.1
EPSS 0.4% (31th pct)2026-05-25
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
CVE-2026-43828
Patch
CWE-614
Medium · CVSS 5.9
EPSS 0.3% (19th pct)2026-05-25
Apache Shiro: Session fixation: new session is not created after login by default
CVE-2026-43827
Patch
CWE-384
Medium · CVSS 5.9
EPSS 0.4% (33th pct)2026-05-25
Apache Shiro: Brute force attack possible to determine valid user names
CVE-2026-23901
Patch
CWE-208
Low · CVSS 1.0
EPSS 0.2% (12th pct)2026-02-10
Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
CVE-2026-23903
Patch
CWE-289
Medium · CVSS 5.3
EPSS 0.4% (29th pct)2026-02-09
Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
CVE-2023-46749
Patch
CWE-22
Medium · CVSS 6.5
EPSS 1.2% (64th pct)2024-01-15
Medium vulnerability · 2023-12-14
CVE-2023-46750
Public exploit
Patch
CWE-601
Medium · CVSS 6.1
EPSS 1.5% (71th pct)2023-12-14
Critical vulnerability · 2023-07-24
CVE-2023-34478
Patch
CWE-22
Critical · CVSS 9.8
EPSS 1.5% (72th pct)2023-07-24
Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request
CVE-2023-22602
Patch
CWE-436
High · CVSS 7.5
EPSS 1.6% (72th pct)2023-01-14
Critical vulnerability · 2022-10-12
CVE-2022-40664
Patch
CWE-287
Critical · CVSS 9.8
EPSS 2.2% (81th pct)2022-10-12
Critical vulnerability · 2022-06-28
CVE-2022-32532
Patch
CWE-863
Critical · CVSS 9.8
EPSS 25.4% (98th pct)2022-06-28
Critical vulnerability · 2021-09-17
CVE-2021-41303
Patch
CWE-287
Critical · CVSS 9.8
EPSS 76.7% (99th pct)2021-09-17
Critical vulnerability · 2021-02-03
CVE-2020-17523
Patch
Critical · CVSS 9.8
EPSS 85.9% (100th pct)2021-02-03
Critical vulnerability · 2020-11-05
CVE-2020-17510
Patch
Critical · CVSS 9.8
EPSS 9.1% (95th pct)2020-11-05
High vulnerability · 2020-08-17
CVE-2020-13933
Patch
High · CVSS 7.5
EPSS 48.0% (99th pct)2020-08-17
Critical vulnerability · 2020-06-22
CVE-2020-11989
Patch
Critical · CVSS 9.8
EPSS 24.4% (98th pct)2020-06-22
Critical vulnerability · 2020-03-25
CVE-2020-1957
Patch
Critical · CVSS 9.8
EPSS 24.2% (98th pct)2020-03-25
High vulnerability · 2019-11-18
CVE-2019-12422
Patch
High · CVSS 7.5
EPSS 9.1% (95th pct)2019-11-18
High vulnerability · 2016-09-20
CVE-2016-6802
Public exploit
Patch
High · CVSS 7.5
EPSS 9.7% (95th pct)2016-09-20
Critical vulnerability · 2016-06-07
CVE-2016-4437
CISA KEV
Public exploit
Patch
CWE-321
Added to CISA KEV 2021-11-03
Critical · CVSS 9.3
EPSS 93.0% (100th pct)2016-06-07
High vulnerability · 2014-10-06
CVE-2014-0074
Patch
High · CVSS 7.5
EPSS 5.5% (92th pct)2014-10-06
Medium vulnerability · 2010-11-05
CVE-2010-3863
Public exploit
Patch
Medium · CVSS 5.0
EPSS 54.8% (99th pct)2010-11-05

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation shiro CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Apache Software Foundation shiro CVEs were published each year.

2010

1

2014

1

2016

2

2019

1

2020

4

2021

2

2022

2

2023

3

2024

1

2026

7

Other Apache Software Foundation products

Browse vulnerabilities for other products by Apache Software Foundation.

http server351 CVEs tomcat265 CVEs airflow183 CVEs Apache Airflow136 CVEs Apache HTTP Server125 CVEs httpd125 CVEs Apache Tomcat115 CVEs struts91 CVEs

All Apache Software Foundation vulnerabilities

Frequently asked questions

Common questions about Apache Software Foundation shiro vulnerabilities.

How many CVEs does Apache Software Foundation shiro have?: Apache Software Foundation shiro has 24 published CVE records since 2010.
How many Apache Software Foundation shiro CVEs are in CISA KEV?: Yes — 1 of Apache Software Foundation shiro's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Apache Software Foundation shiro vulnerabilities?: Yes — 4 of Apache Software Foundation shiro's CVEs have a known public exploit.
Which versions of Apache Software Foundation shiro are affected?: 94 distinct Apache Software Foundation shiro versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Apache Software Foundation shiro CVEs?: Apache Software Foundation shiro's CVEs most often map to these CWE weakness types: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-287 (Improper Authentication), CWE-384 (Session Fixation).
How many critical Apache Software Foundation shiro vulnerabilities are there?: Apache Software Foundation shiro has 9 critical and 6 high-severity CVEs.
What is the average severity of Apache Software Foundation shiro CVEs?: The average CVSS base score across Apache Software Foundation shiro's scored CVEs is 7.3.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation shiro vulnerabilities

Monitor new Apache Software Foundation shiro vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

< 1.5.21 CVE

< 1.5.31 CVE

< 1.6.01 CVE

< 1.7.01 CVE

< 1.7.11 CVE

< 1.8.01 CVE

< 1.9.11 CVE

< 2.2.11 CVE

<= 1.0.01 CVE

<= 8.01 CVE

<= 8.0.8.2.01 CVE

<= 8.0.8.3.01 CVE

>= to 1.4.11 CVE

1.0.0 <= v <= 1.0.01 CVE

1.1.0 <= v <= 1.1.01 CVE

1.2.0 <= v <= 1.2.01 CVE

1.2.1 <= v <= 1.2.11 CVE

1.2.2 <= v <= 1.2.21 CVE

1.3.1 <= v <= 1.3.11 CVE

2.0.0 <= v < 2.1.11 CVE

2.0.0 <= v < 2.2.11 CVE

1.7.1

1 CVE

1.8.01 CVE

1.9.11 CVE

2b532117ac341a47c27ea8c17262e79fe54aee321 CVE

40bac06d2fd41d7a9e9e0409753b5a409972150c1 CVE

7141f41137f058a3c756ea13ed4e0fef9a3abb661 CVE

8cba15e3b05f56c9d37370fc7636cc86afa2c9781 CVE

a86c51a11c1b6df6b097e312f5709924479edccc1 CVE

adb56c885210eeca710b2df17f6b3aeda85e4f351 CVE

be1144dede3bf1b8b221285a23222faa523bf3181 CVE

c8a294ab32b29a6e9d4b03bbaa6bae11c42daea11 CVE

cae96055605c81b8e670b75bcf9b8f5f0cc8d0c41 CVE

d1653b888509e1c2b280b5fd8f15dfcf8d8da56f1 CVE

e2fcdf3753a9e1d37e8dbe89cd306d01f54fa7121 CVE