29 matches found
cloud.opencode.base:opencode-base-token (1.0.0), com.flowlogix.depchain:shiro-jakarta (>=18, <=133) +22 more potentially affected by CVE-2026-58301 via org.apache.shiro:shiro-jakarta-ee (>=2.0.0-alpha-1, <=3.0.0)
org.apache.shiro:shiro-jakarta-ee MAVEN version =2.0.0-alpha-1, =18, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3, =0.82.10, =0.82.10, =4.7.0, =3.10.0, =3.10.0, =3.10.0, =4.5.0, =4.22.1 and more Source cves: CVE-2026-58301 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-19477229...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the FormResubmitSupport resubmission client in support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java. An attacker can make the server initiate an outbound request ...
cloud.opencode.base:opencode-base-token (1.0.0), com.flowlogix.depchain:shiro-jakarta (>=18, <=133) +22 more potentially affected by CVE-2026-58301 via org.apache.shiro:shiro-jakarta-ee (>=2.0.0-alpha-1, <=3.0.0)
org.apache.shiro:shiro-jakarta-ee MAVEN version =2.0.0-alpha-1, =18, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3, =0.82.10, =0.82.10, =4.7.0, =3.10.0, =3.10.0, =3.10.0, =4.5.0, =4.22.1 and more Source cves: CVE-2026-58301 Source advisory: MEND:CVE-2026-58301...
com.flowlogix.depchain:shiro-jakarta (>=18, <=100), com.flowlogix:jee-examples (>=6.0, <=9.0.3) +40 more potentially affected by CVE-2026-102695 via org.omnifaces:omnifaces (>=4.0, <=4.7.10)
org.omnifaces:omnifaces MAVEN version =4.0, =18, =6.0, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-m3, =7.0.0-m2, =7.0.0-m2, =7.0.0-m1, =7.0.0-m1, =7.0.0-m7 and more Source cves: CVE-2026-102695...
cloud.opencode.base:opencode-base-token (1.0.0), com.flowlogix.depchain:shiro-jakarta (>=18, <=123) +22 more potentially affected by CVE-2026-48589 via org.apache.shiro:shiro-jakarta-ee (>=2.0.0-alpha-1, <=2.2.0)
org.apache.shiro:shiro-jakarta-ee MAVEN version =2.0.0-alpha-1, =18, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3, =0.82.10, =0.82.10, =4.7.0, =3.10.0, =3.10.0, =3.10.0, =4.5.0, =4.20.0 and more Source cves: CVE-2026-48589 Source advisory: OSV:GHSA-7PQ2-FHX9-X464...
cloud.opencode.base:opencode-base-token (1.0.0), com.flowlogix.depchain:shiro-jakarta (>=18, <=119) +22 more potentially affected by CVE-2026-44598 via org.apache.shiro:shiro-jakarta-ee (>=2.0.0-alpha-1, <=2.1.0)
org.apache.shiro:shiro-jakarta-ee MAVEN version =2.0.0-alpha-1, =18, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3, =0.82.10, =0.82.10, =4.7.0, =3.10.0, =3.10.0, =3.10.0, =4.5.0, =4.20.0 and more Source cves: CVE-2026-44598 Source advisory: GHSA-WPQM-4GWX-W843...
cloud.opencode.base:opencode-base-token (1.0.0), com.flowlogix.depchain:shiro-jakarta (>=18, <=119) +22 more potentially affected by CVE-2026-44598 via org.apache.shiro:shiro-jakarta-ee (>=2.0.0-alpha-1, <=2.1.0)
org.apache.shiro:shiro-jakarta-ee MAVEN version =2.0.0-alpha-1, =18, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3, =0.82.10, =0.82.10, =4.7.0, =3.10.0, =3.10.0, =3.10.0, =4.5.0, =4.20.0 and more Source cves: CVE-2026-44598 Source advisory: OSV:GHSA-WPQM-4GWX-W843...
cloud.opencode.base:opencode-base-token (1.0.0), com.flowlogix.depchain:shiro-jakarta (>=18, <=123) +22 more potentially affected by CVE-2026-48589 via org.apache.shiro:shiro-jakarta-ee (>=2.0.0-alpha-1, <=2.2.0)
org.apache.shiro:shiro-jakarta-ee MAVEN version =2.0.0-alpha-1, =18, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3, =0.82.10, =0.82.10, =4.7.0, =3.10.0, =3.10.0, =3.10.0, =4.5.0, =4.20.0 and more Source cves: CVE-2026-48589 Source advisory: GHSA-7PQ2-FHX9-X464...
PT-2026-57355
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module...
Open Redirect
Overview Affected versions of this package are vulnerable to Open Redirect in handling shiroSavedRequest cookies, which use unprotected/unencrypted values for SAVEDREQUESTKEY. An authenticated user can cause the server to make blind HTTP GET requests to arbitrary URLs or redirect users to untrust...
cloud.opencode.base:opencode-base-token (1.0.0), com.flowlogix.depchain:shiro-jakarta (>=18, <=119) +22 more potentially affected by CVE-2026-44598 via org.apache.shiro:shiro-jakarta-ee (>=2.0.0-alpha-1, <=2.1.0)
org.apache.shiro:shiro-jakarta-ee MAVEN version =2.0.0-alpha-1, =18, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3, =0.82.10, =0.82.10, =4.7.0, =3.10.0, =3.10.0, =3.10.0, =4.5.0, =4.20.0 and more Source cves: CVE-2026-44598 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17115416...
Open Redirect
Overview Affected versions of this package are vulnerable to Open Redirect due to insufficient validation of the Referer header in saveRequestReferer. An authenticated user can redirect users to arbitrary external sites by supplying a malicious Referer value during authentication. Remediation...
cloud.opencode.base:opencode-base-token (1.0.0), com.flowlogix.depchain:shiro-jakarta (>=18, <=123) +22 more potentially affected by CVE-2026-48589 via org.apache.shiro:shiro-jakarta-ee (>=2.0.0-alpha-1, <=2.2.0)
org.apache.shiro:shiro-jakarta-ee MAVEN version =2.0.0-alpha-1, =18, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3, =0.82.10, =0.82.10, =4.7.0, =3.10.0, =3.10.0, =3.10.0, =4.5.0, =4.20.0 and more Source cves: CVE-2026-48589 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17115412...
CVE-2026-44598
With valid login credentials, URL Redirection to Untrusted Site 'Open Redirect', Server-Side Request Forgery SSRF vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended t...
UBUNTU-CVE-2026-48589
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module...
CVE-2026-48589 Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module...
cloud.opencode.base:opencode-base-token (1.0.0), com.flowlogix.depchain:shiro-jakarta (>=18, <=123) +22 more potentially affected by CVE-2026-48589 via org.apache.shiro:shiro-jakarta-ee (>=2.0.0-alpha-1, <=2.2.0)
org.apache.shiro:shiro-jakarta-ee MAVEN version =2.0.0-alpha-1, =18, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3, =0.82.10, =0.82.10, =4.7.0, =3.10.0, =3.10.0, =3.10.0, =4.5.0, =4.20.0 and more Source cves: CVE-2026-48589 Source advisory: MEND:CVE-2026-48589...
CVE-2026-48589
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module...
CVE-2026-44598 Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)
With valid login credentials, URL Redirection to Untrusted Site 'Open Redirect', Server-Side Request Forgery SSRF vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended t...
CVE-2026-44598
With valid login credentials, URL Redirection to Untrusted Site 'Open Redirect', Server-Side Request Forgery SSRF vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended t...