Known vulnerabilities in Apache Allura

Vendor: Apache Foundation
Software: Apache Allura
Software CPE: cpe:2.3:a:apache_foundation:allura:*:*:*:*:*:*:*:*
Website: https://www.apache.org
Total vulnerabilities: 16
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Allura Apache Allura is affected by 16 known vulnerabilities: 1 high, 6 medium, 9 low Critical High Medium Low

Vulnerabilities (16)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146871 - Improper Access Control
CVE-2026-81270		 CWE-284 Medium
No
No
 1.21.0 03.09.2026 SB2026090361
#VU146870 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-80190		 CWE-79 Low
No
No
 1.21.0 03.09.2026 SB2026090361
#VU146869 - Server-Side Request Forgery (SSRF)
CVE-2026-80181		 CWE-918 Low
No
No
 1.21.0 03.09.2026 SB2026090361
#VU146868 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-80180		 CWE-79 Medium
No
No
 1.21.0 03.09.2026 SB2026090361
#VU145151 - Improper Access Control
CVE-2026-75099		 CWE-284 Medium
No
No
 1.20.0 25.08.2026 SB2026082549
#VU143924 - Argument Injection or Modification
CVE-2026-73240		 CWE-88 High
No
No
 1.19.1 18.08.2026 SB2026081814
#VU143923 - Improper Handling of Insufficient Permissions or Privileges
CVE-2026-73239		 CWE-280 Medium
No
No
 1.19.1 18.08.2026 SB2026081814
#VU143921 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-73238		 CWE-79 Low
No
No
 1.19.1 18.08.2026 SB2026081814
#VU143919 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-73237		 CWE-79 Low
No
No
 1.19.1 18.08.2026 SB2026081814
#VU143917 - Server-Side Request Forgery (SSRF)
CVE-2026-69223		 CWE-918 Low
No
No
 1.19.1 18.08.2026 SB2026081814
#VU93076 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-38379		 CWE-79 Low
No
No
 1.17.1 22.06.2024 SB2024062206
#VU93075 - Exposure of sensitive information to an unauthorized actor
CVE-2024-36471		 CWE-200 Low
No
No
 1.17.0 22.06.2024 SB2024062205
#VU93074 - Exposure of sensitive information to an unauthorized actor
CVE-2023-46851		 CWE-200 Low
No
No
 1.16.0 22.06.2024 SB2024062204
#VU93073 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-10085		 CWE-79 Low
No
No
 1.11.0 22.06.2024 SB2019061964
#VU93072 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2018-1319		 CWE-113 Medium
No
No
 1.8.1 22.06.2024 SB2018031546
#VU93071 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2018-1299		 CWE-22 Medium
No
No
 1.8.0 22.06.2024 SB2018020624