6 Total advisories
6 Vulnerabilities
0 Malware
Dependency scanning
Check whether org.apache.shiro:shiro-web is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Vulnerabilities
UNKNOWN
CVE-2026-56130
Apache Shiro's "remember me" cookie age is not verified on the server.
UNKNOWN
CVE-2026-43828
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute
MEDIUM 6.1
CVE-2023-46750
Open redirect in Apache Shiro
CRITICAL 9.8
CVE-2023-34478
Path Traversal in Apache Shiro
CRITICAL 9.8
CVE-2020-17523
Authentication bypass in Apache Shiro
HIGH 7.5
CVE-2016-6802
Improper Access Control in Apache Shiro
Browse more Maven advisories
Learn What is SAST?
Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →
Ready to move
Start Securing
Free, no credit card | First findings in minutes