Apache Software Foundation Syncope vulnerabilities

• apache software foundation syncope Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search CVE-2026-114364 9.8 CriticalNovember 2, 2026
• apache software foundation syncope Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass CVE-2026-113687 9.8 CriticalNovember 2, 2026
• apache software foundation syncope Apache Syncope: Delegated administration boundaries can be bypassed for Realm update CVE-2026-113511 9.1 CriticalNovember 2, 2026
• apache software foundation syncope Apache Syncope: AuthProfile value escalation via self-service update CVE-2026-110535 8.8 HighNovember 2, 2026
• apache software foundation syncope Apache Syncope: Remote Code Execution via Flowable JUEL expression CVE-2026-109083 9.8 CriticalNovember 2, 2026
• apache software foundation syncope Apache Syncope: CAS service URL injection via Forwarded HTTP headers CVE-2026-73191 6.1 MediumSeptember 14, 2026
• apache software foundation syncope Apache Syncope: CSV export spreadsheet formula injection CVE-2026-73195 7.3 HighSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Cross-Realm authorization bypass in delegated administration CVE-2026-73236 7.5 HighSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Cross-Realm boundaries reconciliation bypass CVE-2026-73370 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: JWT Access Token takeover CVE-2026-73178 7.5 HighSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Delegating users can grant unowned Roles CVE-2026-73470 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Non-recursive Any search could skip Realms restrictions CVE-2026-73579 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Nested secrets leak cleartext into audit records readable CVE-2026-75015 4.9 MediumSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Incomplete authorization checks for Group members deprovisioning CVE-2026-75030 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search CVE-2026-77051 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values CVE-2026-73668 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Groovy Sandbox escape for empty CommandArgs CVE-2026-77147 6.5 MediumSeptember 14, 2026
• apache software foundation syncope Apache Syncope: ClientApp update entitlement not effective CVE-2026-77181 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist CVE-2026-77883 4.9 MediumSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Unauthenticated reflected XSS in Console and Enduser CVE-2026-78318 6.1 MediumSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Privilege escalation for admin user via JWT authentication CVE-2026-78330 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user CVE-2026-78336 7.5 HighSeptember 14, 2026
• apache software foundation syncope Apache Syncope: SQL injection via sort parameter in Task search CVE-2026-82232 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence CVE-2026-86460 9.8 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: AES Secret Key disclosure via log output CVE-2026-87779 7.5 HighSeptember 14, 2026
• apache software foundation syncope Apache Syncope: JWT subject spoofing CVE-2026-87785 9.1 CriticalSeptember 14, 2026
• apache software foundation syncope Apache Syncope: SRA OAuth2 JWT signature verification bypass CVE-2026-87802 9.1 CriticalSeptember 14, 2026
• apache syncope Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check CVE-2026-62418 8.1 HighJuly 20, 2026
• apache syncope Apache Syncope: User self-service privilege escalation CVE-2026-62183 Public exploit 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: SQL injection vulnerability in Audit Events search CVE-2026-57308 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: Remote Code Execution via Scripted Connector CVE-2026-53421 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask CVE-2026-53405 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: RCE via Groovy Sandbox bypass CVE-2026-63071 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: JexlContextBuilder Information Disclosure CVE-2026-42797 Fix available 4.9 MediumMay 25, 2026
• apache syncope Apache Syncope: Post-auth RCE via Groovy static CVE-2026-42782 Fix available 7.2 HighMay 25, 2026
• apache syncope Apache Syncope: Reflected XSS on Enduser Login CVE-2026-23794 Fix available 6.8 MediumFebruary 3, 2026
• apache syncope Apache Syncope: Console XXE on Keymaster parameters CVE-2026-23795 Fix available 4.9 MediumFebruary 3, 2026
• apache syncope Apache Syncope: Default AES key used for internal password encryption CVE-2025-65998 Fix available 7.5 HighNovember 24, 2025
• apache syncope Apache Syncope: Remote Code Execution by delegated administrators CVE-2025-57738 Fix available EPSS 23.2% 7.2 HighOctober 20, 2025
• apache syncope Apache Syncope: Stored XSS in Console and Enduser CVE-2024-45031 6.1 MediumOctober 24, 2024
• apache syncope Apache Syncope: HTML tags can be injected into Console or Enduser text fields CVE-2024-38503 Fix available 5.4 MediumJuly 22, 2024
• apache syncope Shell command injection in Apache Syncope CVE-2020-11977 Fix available 7.2 HighSeptember 15, 2020
• apache syncope Injection in Apache Syncope CVE-2020-1961 Fix available 9.8 CriticalMay 4, 2020
• apache syncope Cross-site scripting in Apache Syncome EndUser CVE-2019-17557 Fix available 5.4 MediumMay 4, 2020
• apache syncope Expression Language Injection in Apache Syncope CVE-2020-1959 Fix available 9.8 CriticalMay 4, 2020
• apache syncope Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core CVE-2018-17186 Fix available 7.2 HighNovember 6, 2018
• apache syncope Improper Control of Interaction Frequency in Apache syncope-core CVE-2018-17184 Fix available 5.4 MediumNovember 6, 2018
• apache syncope Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope CVE-2018-1322 Public exploitFix available EPSS 19.9% 4.9 MediumMarch 20, 2018
• apache syncope High severity vulnerability that affects org.apache.syncope:syncope-core CVE-2018-1321 Public exploitFix available EPSS 17.5% 7.2 HighMarch 20, 2018