Apereo Foundation has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 6.9 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Worst active — by depth score
CVE-2026-67615High· 8.8openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/…61CVE-2026-66088Critical· 9.4Unrestricted Command Execution via system.execute52CVE-2026-66090High· 7.1XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read39CVE-2026-66091Medium· 6.9Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details38CVE-2026-66089Medium· 6.1XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion34
Apereo Foundation vulnerabilities
CVEs affecting Apereo Foundation, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-16889Medium· 4.8Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user h…
CVE-2026-66088Critical· 9.4Unrestricted Command Execution via system.execute
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can…
CVE-2026-66089Medium· 6.1XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the se…
CVE-2026-66091Medium· 6.9Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal det…
CVE-2026-66092Medium· 4.8Stored XSS in pre-login notice via reachable legacy logon route
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary scri…
CVE-2026-66090High· 7.1XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitra…
CVE-2026-67615High· 8.8PoCopenEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/…
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/…