Intranda vulnerabilities

Products

• Goobi-viewer-core 16
• Goobi Viewer Core 4

Newest

• intranda goobi-viewer-core Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS CVE-2026-55486 9.3 CriticalOctober 23, 2026
• intranda goobi-viewer-core Goobi viewer: Solr injection via unvalidated region parameter in spatial search CVE-2026-55465 5.3 MediumOctober 23, 2026
• intranda goobi-viewer-core Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation CVE-2026-55463 6.5 MediumOctober 23, 2026
• intranda goobi-viewer-core Goobi viewer: OpenID JWT audience not enforced by the verifier CVE-2026-55459 7.4 HighOctober 23, 2026
• intranda goobi-viewer-core Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass CVE-2026-55457 7.4 HighOctober 23, 2026
• intranda goobi-viewer-core Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters CVE-2026-55444 5.3 MediumOctober 23, 2026
• intranda goobi-viewer-core Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer CVE-2026-46652 9.8 CriticalOctober 23, 2026
• intranda goobi-viewer-core Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer CVE-2026-46651 9.8 CriticalOctober 23, 2026
• intranda goobi-viewer-core Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset CVE-2026-46347 6.8 MediumOctober 23, 2026
• intranda goobi-viewer-core Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset CVE-2026-46346 6.5 MediumOctober 23, 2026
• intranda goobi-viewer-core Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection CVE-2026-55442 5.3 MediumOctober 23, 2026
• intranda goobi-viewer-core Goobi viewer: Unauthenticated Solr Streaming Expression Proxy CVE-2026-45083 9.8 CriticalMay 13, 2026
• intranda goobi viewer core, goobi-viewer-core +1 more Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames CVE-2023-29016 Fix available 6.1 MediumApril 6, 2023
• intranda goobi viewer core, goobi-viewer-core +1 more Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments CVE-2023-29015 Fix available 6.1 MediumApril 6, 2023
• intranda goobi viewer core, goobi-viewer-core +1 more Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter CVE-2023-29014 Fix available 6.1 MediumApril 6, 2023
• intranda goobi viewer core, goobi-viewer-core +1 more Path traversal in Goobi viewer Core CVE-2020-15124 9.6 CriticalJuly 22, 2020