Apache Apache Roller
25 CVEs affecting Apache Apache Roller. Latest disclosed: 2026-09-28. Critical: 4, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82377 | Critical | 9.9 | 2026-09-28 | Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the lega… |
CVE-2026-82384 | Critical | 9.8 | 2026-09-28 | Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, becau… |
CVE-2018-17198 | Critical | 9.8 | 2019-05-28 | Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser… |
CVE-2026-82378 | Critical | 9.0 | 2026-09-28 | Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding req… |
CVE-2025-24859 | High | 8.8 | 2025-04-14 | A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes… |
CVE-2026-82383 | High | 8.2 | 2026-09-28 | Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuratio… |
CVE-2026-82380 | High | 8.1 | 2026-09-28 | Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim'… |
CVE-2026-82386 | High | 7.7 | 2026-09-28 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and rea… |
CVE-2026-82379 | High | 7.7 | 2026-09-28 | Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain… |
CVE-2026-82376 | High | 7.7 | 2026-09-28 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse a… |
CVE-2026-82348 | High | 7.7 | 2026-09-28 | Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or de… |
CVE-2021-33580 | High | 7.5 | 2021-08-18 | User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The atta… |
CVE-2026-82375 | High | 7.4 | 2026-09-28 | Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to… |
CVE-2026-82385 | Medium | 6.5 | 2026-09-28 | Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, inc… |
CVE-2026-86507 | Medium | 6.1 | 2026-09-28 | Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in th… |
CVE-2026-91206 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
CVE-2026-91204 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comm… |
CVE-2026-82546 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store… |
CVE-2026-82382 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
CVE-2019-0234 | Medium | 6.1 | 2019-07-15 | A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and coul… |