Apache Shindig vulnerabilities

2 CVEs affecting Apache Shindig, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-66256, published 2026-08-13.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2013-4295, published 2013-10-24. Medium severity, CVSS 5.0. EPSS: 11.7% chance of exploitation in the next 30 days. The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity…
• CVE-2026-66256, published 2026-08-13. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can…