Replay Attack

Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Replay Attack due to the server not verifying the expiration of the...

co.paralleluniverse:comsat-shiro (0.7.0), com.aerospike:aerospike-shiro-session (>=0.0.1, <=1.0.2) +331 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.2.4)

org.apache.shiro:shiro-core MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - co.paralleluniverse:comsat-shiro 0.7.0 - com.aerospike:aerospike-shiro-session =0.0.1, =3.6.1, =1.3.6,...

cc.eamon.open:auth (0.0.2), cn.iisme.cloud:iisme-demos-shiro-web (1.0.1) +333 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.5.3)

org.apache.shiro:shiro-core MAVEN version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - cc.eamon.open:auth 0.0.2 - cn.iisme.cloud:iisme-demos-shiro-web 1.0.1 -...

com.diboot:diboot-file-spring-boot-starter (2.6.0), com.diboot:diboot-iam-spring-boot-starter (2.6.0) +155 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.9.0)

org.apache.shiro:shiro-core MAVEN version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.diboot:diboot-file-spring-boot-starter 2.6.0 - com.diboot:diboot-iam-spring-boot-starter 2.6.0 -...

com.flowlogix:flowlogix-tapestry (>=1.0.1, <=1.2.2), com.flowlogix:tapestry-build-core (>=1.0.1, <=1.2.2) +101 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.2.1)

org.apache.shiro:shiro-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.flowlogix:flowlogix-tapestry =1.0.1, =1.0.1, =1.0, =2.2.0, =3.1.0, =2.0.2, =1.2, =0.1.53, =0.1.34,...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0, <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.0.0, <=5.0.0) +126 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.5.2)

org.apache.shiro:shiro-core MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count =4.0.0, =4.0.0, =4.0.0, =4.0.1, =1.1.1...

LDAP Injection

Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to LDAP Injection in the DefaultLdapRealm class. An attacker can bypass...

cc.jweb:jweb-adai (>=1.0.2, <=1.0.6), cc.jweb:jweb-boot (>=1.0.2, <=1.0.5) +426 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.7.1)

org.apache.shiro:shiro-core MAVEN version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - cc.jweb:jweb-adai =1.0.2, =1.0.2, =1.0.0, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1,...

com.buession.security:buession-security-pac4j (2.3.1), com.buession.security:buession-security-shiro (2.3.1) +259 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.12.0)

org.apache.shiro:shiro-core MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.buession.security:buession-security-pac4j 2.3.1 - com.buession.security:buession-security-shiro 2.3....

cn.xuqiudong.basic:lcxm-cas-sso (>=1.0.1-2024, <=1.0.2-2024), cn.xuqiudong.basic:lcxm-cas-sso-client (>=1.0.1-2024, <=1.0.2-2024) +311 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.6.0)

org.apache.shiro:shiro-core MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - cn.xuqiudong.basic:lcxm-cas-sso =1.0.1-2024, =1.0.1-2024, =1.0.1-2024, =3.0, =3.0, =3.0, =1.0, =1.1.0,...

be.fluid-it.guice.extensions:guice-multi-shiro-realms (0.1-1), be.fluid-it.shiro.jee:shiro-jee-authc (>=0.1-1, <=0.1-3) +342 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.2.3)

org.apache.shiro:shiro-core MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - be.fluid-it.guice.extensions:guice-multi-shiro-realms 0.1-1 - be.fluid-it.shiro.jee:shiro-jee-authc =0.1-...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=5.1.0, <=5.2.1), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (>=5.1.0, <=5.1.3) +229 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.11.0)

org.apache.shiro:shiro-core MAVEN version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard =5.1.0, =5.1.0, =5.1.0, =2.2.0, =2.2.0,...

cn.joylau.code:joylau-shiro-freemark (1.0), com.erlitech:ejava (>=1.1.0, <=1.1.15) +39 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.3.0)

org.apache.shiro:shiro-core MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - cn.joylau.code:joylau-shiro-freemark 1.0 - com.erlitech:ejava =1.1.0, =1.0.9, =1.0.9, =1.0.9, =1.0.4,...

br.eti.arthurgregorio:shiro-ee (1.5.1), cn.chenzw.toolkit:toolkit (1.0.3-a) +260 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.4.2)

org.apache.shiro:shiro-core MAVEN version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - br.eti.arthurgregorio:shiro-ee 1.5.1 - cn.chenzw.toolkit:toolkit 1.0.3-a -...

br.com.caelum.vraptor:vraptor-shiro (>=4.0.0-beta-1, <=4.0.0-rc2), com.flowlogix:flowlogix-tapestry (>=1.2.3, <=1.2.10) +210 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.2.2)

org.apache.shiro:shiro-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - br.com.caelum.vraptor:vraptor-shiro =4.0.0-beta-1, =1.2.3, =1.2.3, =1.0.0.release, =2.1.3, =2.1.3, =1.0,...

be.fluid-it.guice.extensions:guice-multi-shiro-realms (0.1-1), be.fluid-it.shiro.jee:shiro-jee-authc (>=0.1-1, <=0.1-3) +3122 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (>=1.0.0-incubating, <=2.1.0)

org.apache.shiro:shiro-core MAVEN version =1.0.0-incubating, =0.1-1, =4.0.0-beta-1, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.30 - cc.eamon.open:auth 0.0.2 - cc.ereach:ereach-permission 1.0.1 and more Source cves: CVE-2026-43827 Source advisory:...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +20 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (3.0.0-alpha-1)

org.apache.shiro:shiro-core MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

be.fluid-it.guice.extensions:guice-multi-shiro-realms (0.1-1), be.fluid-it.shiro.jee:shiro-jee-authc (>=0.1-1, <=0.1-3) +3122 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (>=1.0.0-incubating, <=2.1.0)

org.apache.shiro:shiro-core MAVEN version =1.0.0-incubating, =0.1-1, =4.0.0-beta-1, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.30 - cc.eamon.open:auth 0.0.2 - cc.ereach:ereach-permission 1.0.1 and more Source cves: CVE-2026-43827 Source advisory:...

Session Fixation

Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Session Fixation during the login operation in...

ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2), ca.ibodrov.concord:testcontainers-concord-core (>=2.0.3, <=2.0.5) +315 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (>=2.0.0-alpha-1, <=2.1.0)

org.apache.shiro:shiro-core MAVEN version =2.0.0-alpha-1, =0.0.1, =2.0.3, =0.0.27, =0.0.27, =0.0.27, =6.0.0, =8.0.0, =8.0.0, =8.20.0, =2.2.0-m1, =1.0.2, =3.4.0, =3.3.0, =3.8.0 and more Source cves: CVE-2026-43827 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17116505...