sakai vulnerabilities
CVEs whose affected-version data names the sakai package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-54049High· 8.7PoCSakai is a Collaboration and Learning Environment (CLE)
Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders…
CVE-2026-54050Medium· 6.5PoCSakai is a Collaboration and Learning Environment (CLE)
Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.r…
CVE-2025-62710Medium· 5.9Sakai is a Collaboration and Learning Environment
Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. jav…