Skip to contentIntranda Goobi-viewer-core vulnerabilities
- intranda goobi-viewer-coreGoobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSSCVE-2026-554869.3 Critical
- intranda goobi-viewer-coreGoobi viewer: Solr injection via unvalidated region parameter in spatial searchCVE-2026-554655.3 Medium
- intranda goobi-viewer-coreGoobi viewer: WebSocket endpoints lack server-side authentication and origin validationCVE-2026-554636.5 Medium
- intranda goobi-viewer-coreGoobi viewer: OpenID JWT audience not enforced by the verifierCVE-2026-554597.4 High
- intranda goobi-viewer-coreGoobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypassCVE-2026-554577.4 High
- intranda goobi-viewer-coreGoobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parametersCVE-2026-554445.3 Medium
- intranda goobi-viewer-corePath traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerCVE-2026-466529.8 Critical
- intranda goobi-viewer-coreUnauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerCVE-2026-466519.8 Critical
- intranda goobi-viewer-coreGoobi viewer: Predictable Replacement Password Allows Account Takeover After Password ResetCVE-2026-463476.8 Medium
- intranda goobi-viewer-coreGoobi viewer: Predictable Password Reset Token Allows Unauthorized Password ResetCVE-2026-463466.5 Medium
- intranda goobi-viewer-coreGoobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injectionCVE-2026-554425.3 Medium
- intranda goobi-viewer-coreGoobi viewer: Unauthenticated Solr Streaming Expression ProxyCVE-2026-450839.8 Critical
- intranda goobi viewer core, goobi-viewer-core +1 moreGoobi viewer Core has Cross-Site Scripting Vulnerability in User NicknamesCVE-2023-29016Fix available6.1 Medium
- intranda goobi viewer core, goobi-viewer-core +1 moreGoobi viewer Core has Cross-Site Scripting Vulnerability in User CommentsCVE-2023-29015Fix available6.1 Medium
- intranda goobi viewer core, goobi-viewer-core +1 moreGoobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID ParameterCVE-2023-29014Fix available6.1 Medium
- intranda goobi viewer core, goobi-viewer-core +1 morePath traversal in Goobi viewer CoreCVE-2020-151249.6 Critical