Apache Allura vulnerabilities

• apache allura Apache Allura: Unauthenticated REST disclosure CVE-2026-75099 5.3 MediumAugust 24, 2026
• apache allura Apache Allura: XSS in markdown pipeline CVE-2026-73237 6.1 MediumAugust 12, 2026
• apache allura Apache Allura: XSS in code display CVE-2026-73238 6.1 MediumAugust 12, 2026
• apache allura Apache Allura: Missing permission checks IDOR CVE-2026-73239 6.5 MediumAugust 12, 2026
• apache allura Apache Allura: Git command injection CVE-2026-73240 9.8 CriticalAugust 12, 2026
• apache allura Apache Allura: Server-side request forgery CVE-2026-69223 9.1 CriticalAugust 11, 2026
• apache allura Apache Allura: Stored authenticated XSS CVE-2024-38379 4.8 MediumJune 22, 2024
• apache allura Apache Allura: sensitive information exposure via DNS rebinding CVE-2024-36471 7.5 HighJune 10, 2024
• apache allura Apache Allura: sensitive information exposure via import CVE-2023-46851 4.9 MediumNovember 7, 2023
• apache allura In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown... CVE-2019-10085 6.1 MediumJune 18, 2019
• apache allura In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If... CVE-2018-1319 6.1 MediumMarch 15, 2018
• apache allura In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the... CVE-2018-1299 7.5 HighFebruary 6, 2018