339 matches found
Exploit for Special Element Injection in Apache Apisix
CVE-2026-31908 - Apache APISIX Header Injection Exploit !Se...
CVE-2026-27143 vulnerabilities
Vulnerabilities for packages: renovate, redpanda, snyk-cli, opentelemetry-operator, wireguard-go, nri-consul, container-object-storage-interface, grafana-operator, cloud-provider-aws, xcover, secrets-store-csi-driver-provider-azure, dgraph, cadvisor, gitlab-kas, knative-eventing, argo-cd, mage,...
GHSA-CFP9-33RC-J74F vulnerabilities
Vulnerabilities for packages: renovate, redpanda, snyk-cli, opentelemetry-operator, wireguard-go, nri-consul, container-object-storage-interface, grafana-operator, cloud-provider-aws, xcover, secrets-store-csi-driver-provider-azure, dgraph, cadvisor, gitlab-kas, knative-eventing, argo-cd, mage,...
GHSA-CQRX-3M42-5P5W vulnerabilities
Vulnerabilities for packages: renovate, redpanda, snyk-cli, opentelemetry-operator, wireguard-go, nri-consul, container-object-storage-interface, grafana-operator, cloud-provider-aws, xcover, secrets-store-csi-driver-provider-azure, dgraph, cadvisor, gitlab-kas, knative-eventing, argo-cd, mage,...
CVE-2026-27144 vulnerabilities
Vulnerabilities for packages: renovate, redpanda, snyk-cli, opentelemetry-operator, wireguard-go, nri-consul, container-object-storage-interface, grafana-operator, cloud-provider-aws, xcover, secrets-store-csi-driver-provider-azure, dgraph, cadvisor, gitlab-kas, knative-eventing, argo-cd, mage,...
GHSA-CFP9-33RC-J74F vulnerabilities
Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, spire-server, coredns-fips, commercial-chainloop-backend, kubernetes-csi-node-driver-registrar-fips, dataplaneapi-fips, aws-eks-pod-identity-agent-fips, regclient, consul-fips, git-credential-oauth, harbor, traefik-fips,...
CVE-2026-27143 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, spire-server, coredns-fips, commercial-chainloop-backend, kubernetes-csi-node-driver-registrar-fips, dataplaneapi-fips, aws-eks-pod-identity-agent-fips, regclient, consul-fips, git-credential-oauth, harbor, traefik-fips,...
GHSA-CQRX-3M42-5P5W vulnerabilities
Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, spire-server, coredns-fips, commercial-chainloop-backend, kubernetes-csi-node-driver-registrar-fips, dataplaneapi-fips, aws-eks-pod-identity-agent-fips, regclient, consul-fips, git-credential-oauth, harbor, traefik-fips,...
CVE-2026-27144 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, spire-server, coredns-fips, commercial-chainloop-backend, kubernetes-csi-node-driver-registrar-fips, dataplaneapi-fips, aws-eks-pod-identity-agent-fips, regclient, consul-fips, git-credential-oauth, harbor, traefik-fips,...
BIT-APISIX-2026-31924 Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
BIT-APISIX-2026-31923 Apache APISIX: Openid-connect `tls_verify` field is disabled by default
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
BIT-APISIX-2026-31908 Apache APISIX: forward auth plugin allows header injection
Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2026-31908
Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2026-31908
Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2026-31924
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2026-31923
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
CVE-2026-31923 Apache APISIX: Openid-connect `tls_verify` field is disabled by default
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
CVE-2026-31923
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
EUVD-2026-22239
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
CVE-2026-31923
CVE-2026-31923 affects Apache APISIX (0.7–3.15.0) due to openid-connect plugin tls_verify/ssl_verify being disabled by default, enabling cleartext transmission of sensitive information. The CVSSv3.1 base score is 7.5 (Network attack, Low attack complexity, no privileges or user interaction, Confi...