Allura (Apache) - vulnerabilities (CVEs)
12 CVEs, 0 in the last 30 days, 30 known versions, newest CVE from 2026-08-24. Vendor: Apache.
CVEs of Allura
- CVE-2026-75099 - CVSS 5.3 (medium), 2026-08-24: Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade…
- CVE-2026-73237 - CVSS 6.1 (medium), 2026-08-12: XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to…
- CVE-2026-73238 - CVSS 6.1 (medium), 2026-08-12: XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which…
- CVE-2026-73239 - CVSS 6.5 (medium), 2026-08-12: Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura:…
- CVE-2026-73240 - CVSS 9.8 (critical), 2026-08-12: Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to…
- CVE-2026-69223 - CVSS 9.1 (critical), 2026-08-11: Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to…
- CVE-2024-38379 - CVSS 4.8 (medium), 2024-06-22: Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is…
- CVE-2024-36471 - CVSS 7.5 (high), 2024-06-10: Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports,…
- CVE-2023-46851 - CVSS 4.9 (medium), 2023-11-07: Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could…
- CVE-2019-10085 - CVSS 6.1 (medium), 2019-06-19: In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when…
- CVE-2018-1319 - CVSS 6.1 (medium), 2018-03-15: In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results…
- CVE-2018-1299 - CVSS 7.5 (high), 2018-02-06: In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura,…
