Apache Syncope vulnerabilities

• apache syncope Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check CVE-2026-62418 8.1 HighJuly 20, 2026
• apache syncope Apache Syncope: User self-service privilege escalation CVE-2026-62183 Public exploit 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: SQL injection vulnerability in Audit Events search CVE-2026-57308 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: Remote Code Execution via Scripted Connector CVE-2026-53421 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask CVE-2026-53405 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: RCE via Groovy Sandbox bypass CVE-2026-63071 9.8 CriticalJuly 20, 2026
• apache syncope Apache Syncope: JexlContextBuilder Information Disclosure CVE-2026-42797 Fix available 4.9 MediumMay 25, 2026
• apache syncope Apache Syncope: Post-auth RCE via Groovy static CVE-2026-42782 Fix available 7.2 HighMay 25, 2026
• apache syncope Apache Syncope: Reflected XSS on Enduser Login CVE-2026-23794 Fix available 6.8 MediumFebruary 3, 2026
• apache syncope Apache Syncope: Console XXE on Keymaster parameters CVE-2026-23795 Fix available 4.9 MediumFebruary 3, 2026
• apache syncope Apache Syncope: Default AES key used for internal password encryption CVE-2025-65998 Fix available 7.5 HighNovember 24, 2025
• apache syncope Apache Syncope: Remote Code Execution by delegated administrators CVE-2025-57738 Fix available EPSS 23.2% 7.2 HighOctober 20, 2025
• apache syncope Apache Syncope: Stored XSS in Console and Enduser CVE-2024-45031 6.1 MediumOctober 24, 2024
• apache syncope Apache Syncope: HTML tags can be injected into Console or Enduser text fields CVE-2024-38503 Fix available 5.4 MediumJuly 22, 2024
• apache syncope Shell command injection in Apache Syncope CVE-2020-11977 Fix available 7.2 HighSeptember 15, 2020
• apache syncope Injection in Apache Syncope CVE-2020-1961 Fix available 9.8 CriticalMay 4, 2020
• apache syncope Cross-site scripting in Apache Syncome EndUser CVE-2019-17557 Fix available 5.4 MediumMay 4, 2020
• apache syncope Expression Language Injection in Apache Syncope CVE-2020-1959 Fix available 9.8 CriticalMay 4, 2020
• apache syncope Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core CVE-2018-17186 Fix available 7.2 HighNovember 6, 2018
• apache syncope Improper Control of Interaction Frequency in Apache syncope-core CVE-2018-17184 Fix available 5.4 MediumNovember 6, 2018
• apache syncope Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope CVE-2018-1322 Public exploitFix available EPSS 19.9% 4.9 MediumMarch 20, 2018
• apache syncope High severity vulnerability that affects org.apache.syncope:syncope-core CVE-2018-1321 Public exploitFix available EPSS 17.5% 7.2 HighMarch 20, 2018
• apache syncope Apache Syncope uses a weak PNRG CVE-2014-3503 Fix available 5.0 MediumJuly 11, 2014
• apache syncope Apache Syncope JEXL Code Injection CVE-2014-0111 Fix available 6.5 MediumApril 17, 2014