Login Request a demo
GO
Product
goobi-viewer-core
by intranda · last CVE Oct 23, 2026
16
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Vulnerabilities16In the news0Timeline
Severity mix
Critical 4High 2Medium 10Low 0
Severity
All severities16Critical4High2Medium10Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add goobi-viewer-core to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-46347
New
6.8
0%
Oct 23
Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset
Affected: < 26.05
CVE-2026-55463
New
6.5
0%
Oct 23
Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation
Affected: >= 4.11.0, < 26.05
CVE-2026-46346
New
6.5
0%
Oct 23
Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
Affected: < 26.05
CVE-2020-15124
6.5
2%
Jul 22
In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application
Affected: before 4.8.3
CVE-2023-29016
6.1
0%
Apr 6
Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames
Affected: < 23.03
CVE-2023-29015
6.1
0%
Apr 6
Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments
Affected: < 23.03
CVE-2023-29014
6.1
0%
Apr 6
Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter
Affected: < 23.03
CVE-2026-55465
New
5.3
0%
Oct 23
Goobi viewer: Solr injection via unvalidated region parameter in spatial search
Affected: >= 22.04, < 26.05
CVE-2026-55444
New
5.3
0%
Oct 23
Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
Affected: < 26.05
CVE-2026-55442
New
5.3
0%
Oct 23
Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection
Affected: >= 23.03, < 26.05
Showing 10