AF
Vendor
Apereo Foundation
7
CVEs
0
On KEV
6
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-66092 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS in pre-login notice via reachable legacy logon route |
| CVE-2026-66091 New | OP openEQUELLA Apereo Foundation | 6.9 | Oct 29 | Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details |
| CVE-2026-66090 New | OP openEQUELLA Apereo Foundation | 7.1 | Oct 29 | XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read |
| CVE-2026-66089 New | OP openEQUELLA Apereo Foundation | 6.1 | Oct 29 | XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion |
| CVE-2026-66088 New | OP openEQUELLA Apereo Foundation | 9.4 | Oct 29 | Unrestricted Command Execution via system.execute |
| CVE-2026-16889 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin |
| CVE-2026-67615 | OP openEQUELLA Apereo Foundation | 8.8 | Sep 22 | openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker |