Priority CRITICAL 100KEV
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.96069 · Published 2022-02-11 · Fixed in 2.12.1, 2.10.4 CWE-290
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 67
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.73585 · Published 2020-12-07 · No fix listed
Priority MEDIUM 48
Header injection vulnerability in Apache APISIX.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00521 · Published 2026-04-14 · No fix listed CWE-75
Priority MEDIUM 47
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02481 · Published 2022-03-28 · No fix listed CWE-20
Priority MEDIUM 47
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.13044 · Published 2021-11-22 · No fix listed CWE-77
Priority MEDIUM 45
Inefficient Algorithmic Complexity vulnerability in Apache APISIX.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0074 · Published 2026-08-27 · No fix listed CWE-407
Priority MEDIUM 44
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0814 · Published 2022-04-20 · No fix listed CWE-209
Priority LOW 39
Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0048 · Published 2025-10-31 · Fixed in 3.14 CWE-532
Priority LOW 38
Authentication Bypass by Spoofing vulnerability in Apache APISIX.
CVSS 4.0HIGH 7.0· Network · No auth · No interaction · EPSS 0.00635 · Published 2026-06-19 · No fix listed CWE-290
Priority LOW 38
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0025 · Published 2026-04-14 · No fix listed CWE-319
Priority LOW 35
Authentication Bypass by Capture-replay vulnerability in Apache APISIX.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00689 · Published 2026-06-19 · No fix listed CWE-294
Priority LOW 35
Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00207 · Published 2025-07-06 · No fix listed CWE-732
Priority LOW 34
Improper Validation of Integrity Check Value vulnerability in Apache APISIX.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00296 · Published 2026-06-19 · No fix listed CWE-354
Priority LOW 33
Improper Input Validation vulnerability in Apache APISIX.
CVSS 4.0MEDIUM 5.8· Network · Low privileges · No interaction · EPSS 0.00676 · Published 2026-06-19 · No fix listed CWE-20
Priority LOW 32
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX.
CVSS 4.0HIGH 7.0· Network · No auth · No interaction · EPSS 0.00546 · Published 2026-08-27 · No fix listed CWE-90
Priority LOW 32
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX.
CVSS 4.0HIGH 7.0· Network · No auth · No interaction · EPSS 0.00594 · Published 2026-08-27 · No fix listed CWE-444
Priority LOW 30
Incorrect Authorization vulnerability in Apache APISIX.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00472 · Published 2026-06-19 · No fix listed CWE-863
Priority LOW 30
Insufficient Verification of Data Authenticity vulnerability in Apache APISIX.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00281 · Published 2026-06-19 · No fix listed CWE-345
Priority LOW 30
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00238 · Published 2026-04-14 · No fix listed CWE-319
Priority LOW 30
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.01065 · Published 2024-05-02 · No fix listed CWE-444
Priority LOW 25
Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00682 · Published 2026-08-26 · No fix listed CWE-807
Priority LOW 25
Improper Authentication vulnerability in Apache APISIX.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00526 · Published 2026-06-19 · No fix listed CWE-287
Priority LOW 25
A vulnerability of plugin openid-connect in Apache APISIX.
CVSS 3.1MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00482 · Published 2025-07-02 · Fixed in 3.12.0 CWE-302
Priority LOW 13
Authentication Bypass by Spoofing vulnerability in opa plugin.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00575 · Published 2026-06-19 · No fix listed CWE-290
Load more
THREATIST.IORead the docs