CVE-2026-31924

>= 2.99.0 and < 3.16.0

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP

5.3MEDIUM

CVE-2026-31923

>= 0.7 and < 3.16.0

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to ssl_verify in openid-conn

7.5HIGH

CVE-2026-31908

>= 2.12.0 and < 3.16.0

Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin

9.1CRITICAL

CVE-2025-62232

>= 1.0 and < 3.14.0

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded t

7.5HIGH

CVE-2025-27446

>= 0.2 and <= 0.5

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file pe

7.8HIGH

CVE-2025-46647

< 3.12.0

A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following c

5.3MEDIUM

CVE-2024-32638

all versions

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using forward-auth

6.3MEDIUM

CVE-2023-44487

< 3.6.1

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams q

7.5HIGH

CVE-2022-29266

< 2.13.1

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error messag

7.5HIGH

CVE-2022-25757

< 2.13.0

In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the resul

9.8CRITICAL

CVE-2022-24112

< 2.10.4

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuratio

9.8CRITICAL

CVE-2021-43557

< 2.10.2

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original

7.5HIGH

CVE-2020-13945

>= 1.2 and <= 1.5

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default to

6.5MEDIUM