[ Vendor · 6 CVEs ]
Apereo Foundation
CVEs affecting Apereo Foundation published in the last 30 days, plus any Apereo Foundation CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-66092 | 29 Oct 2026 | CVSS 4.8 | Apereo Foundation openEQUELLAIn openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user… | |
| CVE-2026-66088 | 29 Oct 2026 | CVSS 9.4 | Apereo Foundation openEQUELLAIn openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without… | |
| CVE-2026-66089 | 29 Oct 2026 | CVSS 6.1 | Apereo Foundation openEQUELLAIn openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows… | |
| CVE-2026-66090 | 29 Oct 2026 | CVSS 7.1 | Apereo Foundation openEQUELLAIn openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items… | |
| CVE-2026-66091 | 29 Oct 2026 | CVSS 6.9 | Apereo Foundation openEQUELLAIn openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated… | |
| CVE-2026-16889 | 29 Oct 2026 | CVSS 4.8 | Apereo Foundation openEQUELLAIn openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of… |