apache_cocoon vulnerabilities
CVEs whose affected-version data names the apache_cocoon package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-108088High· 7.5Apache Cocoon: Cross-user cache poisoning
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users…
CVE-2026-108087High· 8.8Apache Cocoon: SQL Injection
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would all…
CVE-2026-108086High· 7.5Apache Cocoon: XEE could lead to SSRF and information disclosure
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could l…
CVE-2026-108089High· 7.5Apache Cocoon: Unauthenticated access to diagnostic interfaces
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache,…