Allura

This hub aggregates every CVE we track for Allura, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 11 most recently published vulnerabilities affecting Allura.

• CVE-2026-73237Apache Allura: XSS in markdown pipeline6.1Aug 12, 2026
• CVE-2026-73238Apache Allura: XSS in code display6.1Aug 12, 2026
• CVE-2026-73239Apache Allura: Missing permission checks IDOR6.5Aug 12, 2026
• CVE-2026-73240Apache Allura: Git command injection9.8Aug 12, 2026
• CVE-2026-69223Apache Allura: Server-side request forgery9.1Aug 11, 2026
• CVE-2024-38379Apache Allura: Stored authenticated XSS4.8Jun 22, 2024
• CVE-2024-36471Apache Allura: sensitive information exposure via DNS rebinding7.5Jun 10, 2024
• CVE-2023-46851Apache Allura: sensitive information exposure via import4.9Nov 7, 2023
• CVE-2019-10085In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on th...6.1Jun 18, 2019
• CVE-2018-1319In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results may occur including XSS or service deni...6.1Mar 15, 2018
• CVE-2018-1299In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura, such as Nginx, Apache/mod_wsgi or paster ...7.5Feb 6, 2018