Apache Software Foundation Roller vulnerabilities

• apache software foundation roller Apache Roller: Stored XSS in comment moderation via comment author URL CVE-2026-86507 6.1 MediumSeptember 28, 2026
• apache software foundation roller Apache Roller: WSSE digest authentication headers can be replayed CVE-2026-82379 7.7 HighSeptember 28, 2026
• apache software foundation roller Apache Roller: CSRF protection bypass via self-generated salt validation CVE-2026-82380 8.1 HighSeptember 28, 2026
• apache software foundation roller Apache Roller: Stored cross-site scripting in the authoring UI CVE-2026-82381 5.4 MediumSeptember 28, 2026
• apache software foundation roller Apache Roller: Reflected cross-site scripting in the frontpage directory parameter CVE-2026-82382 6.1 MediumSeptember 28, 2026
• apache software foundation roller Apache Roller: Anonymous setup action allows frontpage configuration tampering CVE-2026-82383 8.2 HighSeptember 28, 2026
• apache software foundation roller Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint CVE-2026-82384 Public exploit 9.8 CriticalSeptember 28, 2026
• apache software foundation roller Apache Roller: Server-side request forgery via entry trackback and enclosure URLs CVE-2026-82375 7.4 HighSeptember 28, 2026
• apache software foundation roller Apache Roller: XML external entity processing in trackback response parser CVE-2026-82376 7.7 HighSeptember 28, 2026
• apache software foundation roller Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers CVE-2026-82377 9.9 CriticalSeptember 28, 2026
• apache software foundation roller Apache Roller: OAuth authorization endpoint trusts request-supplied identity CVE-2026-82378 9.0 CriticalSeptember 28, 2026
• apache software foundation roller Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files CVE-2026-82385 6.5 MediumSeptember 28, 2026
• apache software foundation roller Apache Roller: XML external entity processing in OPML bookmark import CVE-2026-82386 7.7 HighSeptember 28, 2026
• apache software foundation roller Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups CVE-2026-82348 7.7 HighSeptember 28, 2026
• apache software foundation roller Apache Roller: Stored cross-site scripting via uploaded media content type CVE-2026-82387 5.4 MediumSeptember 28, 2026
• apache software foundation roller Apache Roller: Stored cross-site scripting through incoming Trackback links CVE-2026-82546 6.1 MediumSeptember 28, 2026
• apache software foundation roller Apache Roller: Stored javascript: URI in HTML comments CVE-2026-91204 6.1 MediumSeptember 28, 2026
• apache software foundation roller Apache Roller: Reflected XSS in the optional LDAP comment authenticator CVE-2026-91206 6.1 MediumSeptember 28, 2026
• apache roller Apache Roller: Insufficient Session Expiration on Password Change CVE-2025-24859 2.1 LowApril 14, 2025
• apache roller Apache Roller: Weakness in CSRF protection allows privilege escalation CVE-2024-46911 4.7 MediumOctober 14, 2024
• apache roller Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode CVE-2024-25090 5.4 MediumJuly 26, 2024
• apache roller Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller si… CVE-2023-37581 5.4 MediumAugust 6, 2023
• apache roller regex injection leading to DoS CVE-2021-33580 7.5 HighAugust 18, 2021
• apache roller A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math... CVE-2019-0234 6.1 MediumJuly 15, 2019
• apache roller Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2... CVE-2018-17198 9.8 CriticalMay 28, 2019