# org.apache.solr:solr-core (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/org-apache-solr-solr-core Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/org-apache-solr-solr-core.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in org.apache.solr:solr-core (Maven): 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-44825, was published on 1 June 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 31 (2 critical, 2 exploited in the wild) ## About org.apache.solr:solr-core (Maven) Apache Solr search engine core library for indexing and querying structured data. ## Latest org.apache.solr:solr-core (Maven) vulnerabilities - [CVE-2026-44825: Apache Solr hardcoded credentials in Basic Authentication setup tool](https://junglewise.ai/threats/cve-2026-44825-apache-solr-hardcoded-credentials-in-basic-authentication-setup) (high, CVSS 8.1, published 1 Jun 2026) - [CVE-2026-22022: Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin](https://junglewise.ai/threats/cve-2026-22022-apache-solr-unauthorized-bypass-of-certain-predefined-permission) (low, CVSS 3.1, published 21 Jan 2026) - [CVE-2026-22444: Apache Solr: Insufficient file-access checking in standalone core-creation requests](https://junglewise.ai/threats/cve-2026-22444-apache-solr-insufficient-file-access-checking-in-standalone-core) (low, CVSS 3.1, published 21 Jan 2026) - [CVE-2025-24814: Apache Solr vulnerable to Execution with Unnecessary Privileges](https://junglewise.ai/threats/cve-2025-24814-apache-solr-vulnerable-to-execution-with-unnecessary-privileges) (medium, CVSS 4, published 27 Jan 2025) - [CVE-2024-52012: Apache Solr Relative Path Traversal vulnerability](https://junglewise.ai/threats/cve-2024-52012-apache-solr-relative-path-traversal-vulnerability) (medium, CVSS 4, published 27 Jan 2025) - [CVE-2023-50386: Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets](https://junglewise.ai/threats/cve-2023-50386-apache-solr-backup-restore-apis-allow-for-deployment-of) (low, CVSS 3.1, published 9 Feb 2024) - [CVE-2023-50292: Apache Solr Schema Designer blindly "trusts" all configsets](https://junglewise.ai/threats/cve-2023-50292-apache-solr-schema-designer-blindly-trusts-all-configsets) (info, published 9 Feb 2024) - [CVE-2023-50291: Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies](https://junglewise.ai/threats/cve-2023-50291-apache-solr-can-leak-certain-passwords-due-to-system-property) (low, CVSS 3.1, published 9 Feb 2024) - [CVE-2023-50290: Apache Solr allows read access to host environmet variables](https://junglewise.ai/threats/cve-2023-50290-apache-solr-allows-read-access-to-host-environmet-variables) (low, CVSS 3.1, published 15 Jan 2024) - [CVE-2019-12401: Apache Solr vulnerable to XML Bomb](https://junglewise.ai/threats/cve-2019-12401-apache-solr-vulnerable-to-xml-bomb) (low, CVSS 3.1, published 24 May 2022) - [CVE-2012-6612: Improper Restriction of XML External Entity Reference in Apache Solr](https://junglewise.ai/threats/cve-2012-6612-improper-restriction-of-xml-external-entity-reference-in-apache) (info, published 17 May 2022) - [CVE-2013-6407: Apache Solr UpdateRequestHandler for XML resolves XML External Entities](https://junglewise.ai/threats/cve-2013-6407-apache-solr-updaterequesthandler-for-xml-resolves-xml-external) (info, published 17 May 2022) - [CVE-2013-6408: XML Injection in Apache Solr](https://junglewise.ai/threats/cve-2013-6408-xml-injection-in-apache-solr) (info, published 17 May 2022) - [CVE-2013-6397: Improper Limitation of a Pathname to a Restricted Directory in Apache Solr](https://junglewise.ai/threats/cve-2013-6397-improper-limitation-of-a-pathname-to-a-restricted-directory-in) (info, published 17 May 2022) - [CVE-2015-8795: Improper Neutralization of Input During Web Page Generation in Apache Solr](https://junglewise.ai/threats/cve-2015-8795-improper-neutralization-of-input-during-web-page-generation-in) (low, CVSS 3, published 17 May 2022) - [CVE-2015-8797: Improper Neutralization of Input During Web Page Generation in Apache Solr](https://junglewise.ai/threats/cve-2015-8797-improper-neutralization-of-input-during-web-page-generation-in) (low, CVSS 3, published 17 May 2022) - [CVE-2017-7660: Apache Solr insecure inter-node communication](https://junglewise.ai/threats/cve-2017-7660-apache-solr-insecure-inter-node-communication) (low, CVSS 3, published 14 May 2022) - [CVE-2017-9803: Apache Solr Kerberos delegation token functionality flaws](https://junglewise.ai/threats/cve-2017-9803-apache-solr-kerberos-delegation-token-functionality-flaws) (low, CVSS 3, published 14 May 2022) - [CVE-2020-13957: Incorrect Authorization in Apache Solr](https://junglewise.ai/threats/cve-2020-13957-incorrect-authorization-in-apache-solr) (low, CVSS 3.1, published 10 Feb 2022) - [CVE-2018-11802: Incorrect Authorization in Apache Solr](https://junglewise.ai/threats/cve-2018-11802-incorrect-authorization-in-apache-solr) (low, CVSS 3.1, published 9 Feb 2022) - [CVE-2021-29262: Improper permission handling in Apache Solr](https://junglewise.ai/threats/cve-2021-29262-improper-permission-handling-in-apache-solr) (low, CVSS 3.1, published 10 May 2021) - [CVE-2019-17558: Improper Input Validation in Apache Solr](https://junglewise.ai/threats/cve-2019-17558-apache-solr-velocityresponsewriter-plug-in-remote-code-execution) (critical, exploited in the wild, CVSS 3.1, published 12 Feb 2020) - [CVE-2019-12409: Unrestricted upload of file with dangerous type in Apache Solr](https://junglewise.ai/threats/cve-2019-12409-unrestricted-upload-of-file-with-dangerous-type-in-apache-solr) (low, CVSS 3.1, published 28 Jan 2020) - [CVE-2019-0193: XML External Entity (XXE) Injection in Apache Solr](https://junglewise.ai/threats/cve-2019-0193-apache-solr-dataimporthandler-code-injection-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 1 Aug 2019) - [CVE-2017-3164: Apache Solr SSRF in shards parameter](https://junglewise.ai/threats/cve-2017-3164-apache-solr-ssrf-in-shards-parameter) (high, CVSS 7.5, published 14 Mar 2019) ## Most severe org.apache.solr:solr-core (Maven) vulnerabilities - [CVE-2019-17558: Improper Input Validation in Apache Solr](https://junglewise.ai/threats/cve-2019-17558-apache-solr-velocityresponsewriter-plug-in-remote-code-execution) (critical, exploited in the wild, CVSS 3.1, published 12 Feb 2020) - [CVE-2019-0193: XML External Entity (XXE) Injection in Apache Solr](https://junglewise.ai/threats/cve-2019-0193-apache-solr-dataimporthandler-code-injection-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 1 Aug 2019) - [CVE-2026-44825: Apache Solr hardcoded credentials in Basic Authentication setup tool](https://junglewise.ai/threats/cve-2026-44825-apache-solr-hardcoded-credentials-in-basic-authentication-setup) (high, CVSS 8.1, published 1 Jun 2026) - [CVE-2017-3164: Apache Solr SSRF in shards parameter](https://junglewise.ai/threats/cve-2017-3164-apache-solr-ssrf-in-shards-parameter) (high, CVSS 7.5, published 14 Mar 2019) - [CVE-2024-52012: Apache Solr Relative Path Traversal vulnerability](https://junglewise.ai/threats/cve-2024-52012-apache-solr-relative-path-traversal-vulnerability) (medium, CVSS 4, published 27 Jan 2025) - [CVE-2025-24814: Apache Solr vulnerable to Execution with Unnecessary Privileges](https://junglewise.ai/threats/cve-2025-24814-apache-solr-vulnerable-to-execution-with-unnecessary-privileges) (medium, CVSS 4, published 27 Jan 2025) - [CVE-2017-12629: Remote code execution occurs in Apache Solr](https://junglewise.ai/threats/cve-2017-12629-remote-code-execution-occurs-in-apache-solr) (low, CVSS 3.1, published 17 Oct 2018) - [CVE-2023-50386: Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets](https://junglewise.ai/threats/cve-2023-50386-apache-solr-backup-restore-apis-allow-for-deployment-of) (low, CVSS 3.1, published 9 Feb 2024) - [CVE-2020-13957: Incorrect Authorization in Apache Solr](https://junglewise.ai/threats/cve-2020-13957-incorrect-authorization-in-apache-solr) (low, CVSS 3.1, published 10 Feb 2022) - [CVE-2023-50290: Apache Solr allows read access to host environmet variables](https://junglewise.ai/threats/cve-2023-50290-apache-solr-allows-read-access-to-host-environmet-variables) (low, CVSS 3.1, published 15 Jan 2024) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core): 259 vulnerabilities - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services): 122 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 60 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [org.elasticsearch:elasticsearch (Maven)](https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch): 41 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "org.apache.solr:solr-core (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-apache-solr-solr-core, 9 November 2026.