CVE Tools
Track your stack

Apache Fineract

24 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Apache Fineract, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Apache Fineract CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Apache Fineract CVEs per month
MonthCVEs
2024-120
2025-010
2025-021
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-123
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-073
2026-080
2026-090
2026-102
2026-110

Severity

How the 24 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical625%
  • High1563%
  • Medium313%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache Fineract.

  1. CVE-2026-64618Apache Fineract: SQL injection vulnerability in Search API9.8
  2. CVE-2026-65874Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints8.8
  3. CVE-2026-57821Apache Fineract: Office list: SQL Injection via Subquery in orderBy8.1
  4. CVE-2026-35152Apache Fineract: SQL injection in runreports endpoint8.8
  5. CVE-2026-56287Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure8.1
  6. CVE-2025-58137Apache Fineract: IDOR via self-service API8.1
  7. CVE-2025-58130Apache Fineract: Server Key not masked9.1
  8. CVE-2025-23408Apache Fineract: weak password policy6.5
  9. CVE-2024-32838Apache Fineract: SQL injection vulnerabilities in offices API endpoint8.8
  10. CVE-2024-23537Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role.8.4
  11. CVE-2024-23538Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.9.9
  12. CVE-2024-23539Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.8.3
  13. CVE-2023-25197apache fineract: SQL injection vulnerability in certain procedure calls 6.3
  14. CVE-2023-25196Apache Fineract: SQL injection vulnerability 4.3
  15. CVE-2023-25195Apache Fineract: SSRF template type vulnerability in certain authenticated users8.1

Product grouping is registry-driven, with AI assist and human review. How it works