Replay Attack

Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Replay Attack due to the server not verifying the expiration of the...

br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1), ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2) +2712 more potentially affected by CVE-2026-56130 via org.apache.shiro:shiro-core (>=1.2.4, <=3.0.0-alpha-1)

org.apache.shiro:shiro-core MAVEN version =1.2.4, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.2, =1.0.0, =1.0.5 - cloud.opencode.base:opencode-base-token 1.0.0 and more Source cves: CVE-2026-56130 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17756768...

LDAP Injection

Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to LDAP Injection in the DefaultLdapRealm class. An attacker can bypass...

be.fluid-it.guice.extensions:guice-multi-shiro-realms (0.1-1), be.fluid-it.shiro.jee:shiro-jee-authc (>=0.1-1, <=0.1-3) +3122 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (>=1.0.0-incubating, <=2.2.0)

org.apache.shiro:shiro-core MAVEN version =1.0.0-incubating, =0.1-1, =4.0.0-beta-1, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.30 - cc.eamon.open:auth 0.0.2 - cc.ereach:ereach-permission 1.0.1 and more Source cves: CVE-2026-49268 Source advisory:...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +20 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (3.0.0-alpha-1)

org.apache.shiro:shiro-core MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

be.fluid-it.guice.extensions:guice-multi-shiro-realms (0.1-1), be.fluid-it.shiro.jee:shiro-jee-authc (>=0.1-1, <=0.1-3) +3122 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (>=1.0.0-incubating, <=2.1.0)

org.apache.shiro:shiro-core MAVEN version =1.0.0-incubating, =0.1-1, =4.0.0-beta-1, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.30 - cc.eamon.open:auth 0.0.2 - cc.ereach:ereach-permission 1.0.1 and more Source cves: CVE-2026-43827 Source advisory:...

be.fluid-it.guice.extensions:guice-multi-shiro-realms (0.1-1), be.fluid-it.shiro.jee:shiro-jee-authc (>=0.1-1, <=0.1-3) +3122 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (>=1.0.0-incubating, <=2.1.0)

org.apache.shiro:shiro-core MAVEN version =1.0.0-incubating, =0.1-1, =4.0.0-beta-1, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.30 - cc.eamon.open:auth 0.0.2 - cc.ereach:ereach-permission 1.0.1 and more Source cves: CVE-2026-43827 Source advisory:...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +20 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (3.0.0-alpha-1)

org.apache.shiro:shiro-core MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

Session Fixation

Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Session Fixation during the login operation in...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +20 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-core (3.0.0-alpha-1)

org.apache.shiro:shiro-core MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute in the for...

ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2), ca.ibodrov.concord:testcontainers-concord-core (>=2.0.3, <=2.0.6) +307 more potentially affected by CVE-2026-44598 via org.apache.shiro:shiro-core (>=2.0.0, <=2.1.0)

org.apache.shiro:shiro-core MAVEN version =2.0.0, =0.0.1, =2.0.3, =0.0.27, =0.0.27, =0.0.27, =6.0.0, =8.0.0, =8.0.0, =8.20.0, =2.2.0-m1, =1.0.2, =3.4.0, =3.3.0, =3.3.0, =3.8.0 and more Source cves: CVE-2026-44598 Source advisory: MEND:CVE-2026-44598...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +20 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-core (3.0.0-alpha-1)

org.apache.shiro:shiro-core MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2), ca.ibodrov.concord:testcontainers-concord-core (>=2.0.3, <=2.0.6) +307 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-core (>=2.0.0, <=2.1.0)

org.apache.shiro:shiro-core MAVEN version =2.0.0, =0.0.1, =2.0.3, =0.0.27, =0.0.27, =0.0.27, =6.0.0, =8.0.0, =8.0.0, =8.20.0, =2.2.0-m1, =1.0.2, =3.4.0, =3.3.0, =3.3.0, =3.8.0 and more Source cves: CVE-2026-43828 Source advisory: MEND:CVE-2026-43828...

be.fluid-it.guice.extensions:guice-multi-shiro-realms (0.1-1), be.fluid-it.shiro.jee:shiro-jee-authc (>=0.1-1, <=0.1-3) +3122 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (>=1.0.0-incubating, <=2.1.0)

org.apache.shiro:shiro-core MAVEN version =1.0.0-incubating, =0.1-1, =4.0.0-beta-1, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.30 - cc.eamon.open:auth 0.0.2 - cc.ereach:ereach-permission 1.0.1 and more Source cves: CVE-2026-43827 Source advisory:...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +20 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-core (3.0.0-alpha-1)

org.apache.shiro:shiro-core MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

Timing Attack

Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Timing Attack in the authentication process. An attacker can infer the...

be.fluid-it.guice.extensions:guice-multi-shiro-realms (0.1-1), be.fluid-it.shiro.jee:shiro-jee-authc (>=0.1-1, <=0.1-3) +3115 more potentially affected by CVE-2026-23901 via org.apache.shiro:shiro-core (>=1.0.0-incubating, <=2.0.6)

org.apache.shiro:shiro-core MAVEN version =1.0.0-incubating, =0.1-1, =4.0.0-beta-1, =1.0.0, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.2, =1.0.6 and more Source cves: CVE-2026-23901 Source advisory: MEND:CVE-2026-23901...

Authentication Bypass by Alternate Name

Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name while serving static files from...

Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8

Summary Third party reported 'Stored XSS' and 'CSRF' issues, Apache Tomcat, Apache ActiveMQ, CKEditor, libcURL, xmlbeans, scala-library, json-smart, jna-platform, jackson-databind, commons-io, shiro-core, commons-net, snappy-java, xercesImpl are identified as vulnerable components with multiple...