How many Apache Software Foundation solr CVEs are in CISA KEV?

Yes — 3 of Apache Software Foundation solr's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of Apache Software Foundation solr are affected?

137 distinct Apache Software Foundation solr versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation solr CVEs?

Apache Software Foundation solr's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-522 (Insufficiently Protected Credentials), CWE-285 (Improper Authorization), CWE-250 (Execution with Unnecessary Privileges).

How many critical Apache Software Foundation solr vulnerabilities are there?

Apache Software Foundation solr has 12 critical and 18 high-severity CVEs.

What is the average severity of Apache Software Foundation solr CVEs?

The average CVSS base score across Apache Software Foundation solr's scored CVEs is 7.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Apache Software Foundation

47 CVEs

3 in CISA KEV

Apache Software Foundation solr Vulnerabilities

Name: Apache Software Foundation solr vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for solr by Apache Software Foundation.

47

Total CVEs

Published

3

In CISA KEV

Exploited in the wild

13

Public exploits

PoC or exploit code

7.4

Avg CVSS

2009–2026

Last updated June 1, 2026

Overview

Apache Software Foundation solr has 47 published CVE records since 2009, of which 3 are in CISA's Known Exploited Vulnerabilities catalog and 13 have a known public exploit. The average CVSS base score across scored CVEs is 7.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation solr, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include linux, typo3, windows.

Severity and exploitation

How the CVSS severity of Apache Software Foundation solr's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical12

High18

Medium16

Low1

In CISA’s Known Exploited Vulnerabilities catalog

3

3 of Apache Software Foundation solr's CVEs are confirmed exploited in the wild.

Public exploits

13

13 of Apache Software Foundation solr's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Apache Software Foundation solr version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

1.3.0 to 1.4.11 CVE
10.0.01 CVE
3.1.0 to 3.6.21 CVE
4.0.0 to 4.10.41 CVE
grafts/lucene-oldest1 CVE
grafts/lucene-solr-copy1 CVE
grafts/lucene-solr-oldest-merged1 CVE
history/branches/lucene-solr/branch_71 CVE
history/branches/lucene-solr/lucene-69971 CVE
history/branches/lucene-solr/lucene/main1 CVE
history/branches/lucene-solr/pointvalues1 CVE
history/branches/lucene-solr/solr/main1 CVE
releases/solr/10.0.01 CVE

Version ranges

4.0.0 <= v <= 4.0.05 CVEs
6.0.0 <= v < 8.11.34 CVEs
< 8.8.23 CVEs
4.1.0 <= v <= 4.1.03 CVEs
4.2.0 <= v <= 4.2.03 CVEs
4.2.1 <= v <= 4.2.13 CVEs
6.2.0 <= v <= 6.2.03 CVEs
6.2.1 <= v <= 6.2.13 CVEs
6.3.0 <= v <= 6.3.03 CVEs
6.4.0 <= v <= 6.4.03 CVEs
8.8.1 <= v <= 8.8.13 CVEs
9.0.0 <= v < 9.4.13 CVEs
<= 4.0.02 CVEs

Fixed in

8.11.34 CVEs
8.8.23 CVEs
9.4.13 CVEs
7.7.32 CVEs
8.11.42 CVEs
8bf0100e502ade4b8161e4b90f762b117a6ef4422 CVEs
9.10.12 CVEs
9.3.02 CVEs
9.7.02 CVEs
9.8.02 CVEs
c135e6335c7158fa26e96b0dc386f825255b47c02 CVEs
> 8.11.21 CVE
6.6.61 CVE
7.7.0

Find a version

47 CVEs

Sort

Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
CVE-2026-44825
Patch
CWE-798
Critical · CVSS 9.8
EPSS 0.6% (44th pct)2026-06-01
Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
CVE-2026-22022
Patch
CWE-285
High · CVSS 8.2
EPSS 0.5% (39th pct)2026-01-21
Apache Solr: Insufficient file-access checking in standalone core-creation requests
CVE-2026-22444
Public exploit
Patch
CWE-20
High · CVSS 7.1
EPSS 0.7% (48th pct)2026-01-21
Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files
CVE-2025-24814
Patch
CWE-250
High · CVSS 7.2
EPSS 1.1% (63th pct)2025-01-27
Medium vulnerability · 2025-01-27
CVE-2024-52012
Public exploit
Patch
CWE-23
Medium · CVSS 6.6
EPSS 47.2% (99th pct)2025-01-27
Apache Solr: ConfigSets created during a backup restore command are trusted implicitly
CVE-2024-45217
Patch
CWE-1188
High · CVSS 8.1
EPSS 0.7% (51th pct)2024-10-16
Apache Solr: Authentication bypass possible using a fake URL Path ending
CVE-2024-45216
Public exploit
Patch
CWE-287
Critical · CVSS 9.3
EPSS 91.0% (100th pct)2024-10-16
High vulnerability · 2024-02-09
CVE-2023-50291
Patch
CWE-522
High · CVSS 7.5
EPSS 3.3% (87th pct)2024-02-09
Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users
CVE-2023-50292
Patch
CWE-732
High · CVSS 7.5
EPSS 3.0% (86th pct)2024-02-09
Medium vulnerability · 2024-02-09
CVE-2023-50298
Patch
CWE-200
Medium · CVSS 6.9
EPSS 1.6% (73th pct)2024-02-09
High vulnerability · 2024-02-09
CVE-2023-50386
Public exploit
Patch
CWE-434
High · CVSS 8.8
EPSS 83.8% (100th pct)2024-02-09
Medium vulnerability · 2024-01-15
CVE-2023-50290
Public exploit
Patch
CWE-200
Medium · CVSS 6.5
EPSS 68.7% (99th pct)2024-01-15
Medium vulnerability · 2023-10-10
CVE-2023-44487
CISA KEV
Public exploit
Patch
CWE-400
Added to CISA KEV 2023-10-10
Medium · CVSS 6.9
EPSS 100.0% (100th pct)2023-10-10
Apache Solr information disclosure vulnerability through DataImportHandler
CVE-2021-44548
Patch
Workaround
CWE-40
Critical · CVSS 9.8
EPSS 5.1% (91th pct)2021-12-23
High vulnerability · 2021-06-16
CVE-2021-33813
Patch
High · CVSS 7.5
EPSS 19.4% (97th pct)2021-06-16
Critical vulnerability · 2021-04-13
CVE-2021-29943
Patch
CWE-863
Critical · CVSS 9.1
EPSS 5.3% (92th pct)2021-04-13
High vulnerability · 2021-04-13
CVE-2021-29262
Patch
Workaround
CWE-522
High · CVSS 7.5
EPSS 7.8% (94th pct)2021-04-13
Critical vulnerability · 2021-04-13
CVE-2021-27905
Public exploit
Patch
Workaround
CWE-918
Critical · CVSS 9.8
EPSS 93.1% (100th pct)2021-04-13
Low vulnerability · 2021-04-01
CVE-2021-28163
Patch
CWE-200
Low · CVSS 2.7
EPSS 4.2% (90th pct)2021-04-01
Medium vulnerability · 2021-02-26
CVE-2020-27223
Public exploit
Patch
CWE-407
Medium · CVSS 5.3
EPSS 78.0% (100th pct)2021-02-26
High vulnerability · 2021-01-26
CVE-2020-9492
Patch
High · CVSS 8.8
EPSS 4.4% (90th pct)2021-01-26
Critical vulnerability · 2020-10-13
CVE-2020-13957
Patch
Critical · CVSS 9.8
EPSS 78.9% (100th pct)2020-10-13
High vulnerability · 2020-08-17
CVE-2020-13941
Patch
High · CVSS 8.8
EPSS 3.8% (89th pct)2020-08-17
Medium vulnerability · 2020-04-01
CVE-2018-11802
Patch
Medium · CVSS 4.3
EPSS 2.0% (79th pct)2020-04-01
Critical vulnerability · 2019-12-30
CVE-2019-17558
CISA KEV
Public exploit
Patch
CWE-74
Added to CISA KEV 2021-11-03
Critical · CVSS 9.0
EPSS 98.6% (100th pct)2019-12-30
Critical vulnerability · 2019-11-18
CVE-2019-12409
Public exploit
Patch
Critical · CVSS 9.8
EPSS 21.9% (97th pct)2019-11-18
High vulnerability · 2019-09-10
CVE-2019-12401
Patch
High · CVSS 7.5
EPSS 7.5% (94th pct)2019-09-10
Critical vulnerability · 2019-08-01
CVE-2019-0193
CISA KEV
Public exploit
Patch
CWE-94
Added to CISA KEV 2021-12-10
Critical · CVSS 9.4
EPSS 83.5% (100th pct)2019-08-01
High vulnerability · 2019-03-08
CVE-2017-3164
Patch
High · CVSS 7.5
EPSS 19.4% (97th pct)2019-03-08
Critical vulnerability · 2019-03-07
CVE-2019-0192
Public exploit
Patch
Critical · CVSS 9.8
EPSS 77.5% (100th pct)2019-03-07

Showing 30 of 47

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation solr CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Apache Software Foundation solr CVEs were published each year.

2013

4

2015

1

2016

3

2017

5

2018

3

2019

6

2020

3

2021

8

2023

1

2024

7

2025

2

2026

3

Other Apache Software Foundation products

Browse vulnerabilities for other products by Apache Software Foundation.

http server351 CVEs tomcat265 CVEs airflow183 CVEs Apache Airflow136 CVEs apache-airflow127 CVEs Apache HTTP Server125 CVEs httpd125 CVEs org.apache.tomcat:tomcat118 CVEs

All Apache Software Foundation vulnerabilities

Frequently asked questions

Common questions about Apache Software Foundation solr vulnerabilities.

How many CVEs does Apache Software Foundation solr have?: Apache Software Foundation solr has 47 published CVE records since 2009.
How many Apache Software Foundation solr CVEs are in CISA KEV?: Yes — 3 of Apache Software Foundation solr's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Apache Software Foundation solr vulnerabilities?: Yes — 13 of Apache Software Foundation solr's CVEs have a known public exploit.
Which versions of Apache Software Foundation solr are affected?: 137 distinct Apache Software Foundation solr versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Apache Software Foundation solr CVEs?: Apache Software Foundation solr's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-522 (Insufficiently Protected Credentials), CWE-285 (Improper Authorization), CWE-250 (Execution with Unnecessary Privileges).
How many critical Apache Software Foundation solr vulnerabilities are there?: Apache Software Foundation solr has 12 critical and 18 high-severity CVEs.
What is the average severity of Apache Software Foundation solr CVEs?: The average CVSS base score across Apache Software Foundation solr's scored CVEs is 7.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation solr vulnerabilities

Monitor new Apache Software Foundation solr vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

3.6.0 <= v <= 3.6.0

2 CVEs

3.6.1 <= v <= 3.6.12 CVEs

3.6.2 <= v <= 3.6.22 CVEs

4.3.0 <= v <= 4.3.02 CVEs

4.3.1 <= v <= 4.3.12 CVEs

4.4.0 <= v <= 4.4.02 CVEs

4.5.0 <= v <= 4.5.02 CVEs

6.0.0 <= v <= 6.0.02 CVEs

6.0.1 <= v <= 6.0.12 CVEs

6.1.0 <= v <= 6.1.02 CVEs

6.4.1 <= v <= 6.4.12 CVEs

6.4.2 <= v <= 6.4.22 CVEs

6.5.0 <= v <= 6.5.02 CVEs

6.5.1 <= v <= 6.5.12 CVEs

9.0.0 <= v < 9.3.02 CVEs

9.0.0 <= v < 9.7.02 CVEs

< 7.7.31 CVE

< 8.11.11 CVE

< 8.6.01 CVE

< 9.4.01 CVE

< 9.8.01 CVE

<= 4.3.01 CVE

<= 4.5.11 CVE

<= 5.01 CVE

<= 5.2.11 CVE

<= 5.31 CVE

<= 5.5.31 CVE

>= 6.0.01 CVE

>= 8.1.1 and 8.2.0 for Linux1 CVE

1.0.0 <= v <= 1.0.01 CVE

1.2 <= v <= 6.6.21 CVE

1.3.0 <= v <= 1.4.11 CVE

1.3.0 <= v <= 7.6.01 CVE

10.0.0 <= v <= 10.0.01 CVE

3.1 <= v <= 3.6.21 CVE

4.0.0 <= v <= 4.10.41 CVE

4.10.0 <= v <= 4.10.01 CVE

4.10.1 <= v <= 4.10.11 CVE

4.10.2 <= v <= 4.10.21 CVE

4.2.0 <= v < 6.6.61 CVE

4.5.1 <= v <= 4.5.11 CVE

4.6.0 <= v <= 4.6.01 CVE

4.6.1 <= v <= 4.6.11 CVE

4.7.0 <= v <= 4.7.01 CVE

4.7.1 <= v <= 4.7.11 CVE

4.7.2 <= v <= 4.7.21 CVE

4.8.0 <= v <= 4.8.01 CVE

4.8.1 <= v <= 4.8.11 CVE

4.9.0 <= v <= 4.9.01 CVE

4.9.1 <= v <= 4.9.11 CVE

5.0.0 <= v < 7.7.31 CVE

5.0.0 <= v <= 5.5.51 CVE

5.3.0 <= v < 8.11.41 CVE

5.3.0 <= v < 9.10.11 CVE

5.3.0 <= v <= 5.3.01 CVE

5.3.1 <= v <= 5.3.11 CVE

5.3.2 <= v <= 5.3.21 CVE

5.4.0 <= v <= 5.4.01 CVE

5.4.1 <= v <= 5.4.11 CVE

5.5.0 <= v <= 5.5.01 CVE

5.5.0 <= v <= 5.5.41 CVE

5.5.1 <= v <= 5.5.11 CVE

5.5.2 <= v <= 5.5.21 CVE

5.5.3 <= v <= 5.5.31 CVE

5.5.4 <= v <= 5.5.41 CVE

6.0.0 <= v <= 6.6.11 CVE

6.0.0 <= v <= 6.6.31 CVE

6.0.0 <= v <= 6.6.41 CVE

6.0.0 <= v <= 6.6.51 CVE

6.0.0 <= v <= 8.11.21 CVE

6.6.0 <= v < 8.11.41 CVE

6.6.0 <= v < 9.8.01 CVE

6.6.0 <= v <= 6.6.01 CVE

6.6.0 <= v <= 6.6.61 CVE

7.0.0 <= v < 7.7.01 CVE

7.0.0 <= v <= 7.0.11 CVE

7.0.0 <= v <= 7.2.11 CVE

7.0.0 <= v <= 7.3.01 CVE

7.0.0 <= v <= 7.3.11 CVE

7.0.0 <= v <= 7.7.31 CVE

8.0.0 <= v < 8.4.01 CVE

8.0.0 <= v <= 8.6.21 CVE

8.1.0 <= v < 8.1.21 CVE

8.1.1 <= v <= 8.1.11 CVE

8.2.0 <= v <= 8.2.01 CVE

8.4.1 <= v <= 8.4.11 CVE

8.6.0 <= v < 9.10.11 CVE

8.6.0 <= v <= 8.6.01 CVE

8.6.2 <= v <= 8.6.21 CVE

8.9 <= v <= 8.91 CVE

9.4.0 <= v <= 9.10.11 CVE

1 CVE

8.1.21 CVE

8.11.11 CVE

8.4.01 CVE

8.6.01 CVE

9.4.01 CVE

de33f50ce79ec1d156faf204553012037e2bc1cb1 CVE