CVE Tools
Track your stack

Allura

12 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Allura, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Allura CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Allura CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-086
2026-090
2026-100

Severity

How the 12 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical217%
  • High217%
  • Medium867%

Latest CVEs

The 12 most recently published vulnerabilities affecting Allura.

  1. CVE-2026-75099Apache Allura: Unauthenticated REST disclosure5.3
  2. CVE-2026-73237Apache Allura: XSS in markdown pipeline6.1
  3. CVE-2026-73238Apache Allura: XSS in code display6.1
  4. CVE-2026-73239Apache Allura: Missing permission checks IDOR6.5
  5. CVE-2026-73240Apache Allura: Git command injection9.8
  6. CVE-2026-69223Apache Allura: Server-side request forgery9.1
  7. CVE-2024-38379Apache Allura: Stored authenticated XSS4.8
  8. CVE-2024-36471Apache Allura: sensitive information exposure via DNS rebinding7.5
  9. CVE-2023-46851Apache Allura: sensitive information exposure via import4.9
  10. CVE-2019-10085In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on th...6.1
  11. CVE-2018-1319In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results may occur including XSS or service deni...6.1
  12. CVE-2018-1299In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura, such as Nginx, Apache/mod_wsgi or paster ...7.5

Product grouping is registry-driven, with AI assist and human review. How it works