CVE Tools
Track your stack

Apisix

29 CVEs tracked. 2 of them are in CISA KEV.

This hub aggregates every CVE we track for Apisix, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.

Apisix CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Apisix CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-072
2025-080
2025-090
2025-101
2025-110
2025-120
2026-010
2026-020
2026-030
2026-043
2026-050
2026-0612
2026-070
2026-084
2026-090
2026-100

Severity

How the 29 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical724%
  • High1448%
  • Medium828%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apisix.

  1. CVE-2026-74848Apache APISIX: Cross-user response poisoning in serverless plugins7.5
  2. CVE-2026-75005Apache APISIX: Unauthenticated CPU-exhaustion DoS7.5
  3. CVE-2026-75020Apache APISIX: ldap-auth plugin cross-subtree identity impersonation8.1
  4. CVE-2026-63041Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers8.8
  5. CVE-2026-49872Apache APISIX: Improper authentication in cas-auth plugin8.1
  6. CVE-2026-49871Apache APISIX: cas-auth login CSRF / session injection issue9.3
  7. CVE-2026-47341Apache APISIX: Session replay issue in hmac-auth6.5
  8. CVE-2026-48895Apache APISIX: Cas-auth Host header influence on CAS service URL7.2
  9. CVE-2026-49231Apache APISIX: Identity spoofing issue in APISIX opa plugin5.4
  10. CVE-2026-49230Apache APISIX: Authentication bypass in jwe-decrypt9.1
  11. CVE-2026-44915Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value6.1
  12. CVE-2026-44087Apache APISIX: Openid-connect plugin Identity Header Spoofing9.1
  13. CVE-2026-47339Apache APISIX: authz-casdoor incorrect session sharing8.1
  14. CVE-2026-44046Apache APISIX: wolf-rbac plugin Identity Spoofing5.8
  15. CVE-2026-39999Apache APISIX: JWT Algorithm Confusion allows authentication bypass9.1

Product grouping is registry-driven, with AI assist and human review. How it works