Topic
Apache Shiro
4 stories about Apache Shiro that passed the news check, newest first.
Security ·
CVE-2026-74763: Apache Shiro: Authorization annotations not always enforced, depending on where they are placed
CVE-2026-74763 affects Apache Shiro's shiro-guice module, where authorization annotations are not always enforced depending on where they are placed.
Open Source Security
Security ·
CVE-2026-88019: Apache Shiro: Saved form replay may weaken cookie security and expose form data
Apache Shiro advisory CVE-2026-88019 covers saved form replay that may weaken cookie security and expose form data.
Open Source Security
Security ·
CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting
Apache Shiro principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting (XSS).
Open Source Security
Security ·
CVE-2026-114737: Apache Shiro: Incorrect default for case-insensitive path matching in ShiroFilterFactoryBean allows auth bypass for static files
Apache Shiro has a case-insensitive path matching issue in the default configuration of ShiroFilterFactoryBean that allows authentication bypass for static files.
Open Source Security