CVE Tools
Track your stack

Fineract

25 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Fineract, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Fineract CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Fineract CVEs per month
MonthCVEs
2024-120
2025-010
2025-021
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-123
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-073
2026-080
2026-090
2026-102
2026-110

Severity

How the 25 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical624%
  • High1664%
  • Medium312%

Latest CVEs

The 15 most recently published vulnerabilities affecting Fineract.

  1. CVE-2026-64618Apache Fineract: SQL injection vulnerability in Search API9.8
  2. CVE-2026-65874Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints8.8
  3. CVE-2026-57821Apache Fineract: Office list: SQL Injection via Subquery in orderBy8.1
  4. CVE-2026-35152Apache Fineract: SQL injection in runreports endpoint8.8
  5. CVE-2026-56287Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure8.1
  6. CVE-2025-58137Apache Fineract: IDOR via self-service API8.1
  7. CVE-2025-58130Apache Fineract: Server Key not masked9.1
  8. CVE-2025-23408Apache Fineract: weak password policy6.5
  9. CVE-2024-32838Apache Fineract: SQL injection vulnerabilities in offices API endpoint8.8
  10. CVE-2024-23537Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role.8.4
  11. CVE-2024-23538Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.9.9
  12. CVE-2024-23539Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.8.3
  13. CVE-2023-25197apache fineract: SQL injection vulnerability in certain procedure calls 6.3
  14. CVE-2023-25196Apache Fineract: SQL injection vulnerability 4.3
  15. CVE-2023-25195Apache Fineract: SSRF template type vulnerability in certain authenticated users8.1

Product grouping is registry-driven, with AI assist and human review. How it works