Apereo Foundation Openequella
7 CVEs affecting Apereo Foundation Openequella. Latest disclosed: 2026-10-29. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-67615 | High | 8.8 | 2026-09-22 | openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary cod… |
CVE-2026-66092 | | 2026-10-29 | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the… | |
CVE-2026-66091 | | 2026-10-29 | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who… | |
CVE-2026-66090 | | 2026-10-29 | In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM)… | |
CVE-2026-66089 | | 2026-10-29 | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker… | |
CVE-2026-66088 | | 2026-10-29 | In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an… | |
CVE-2026-16889 | | 2026-10-29 | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files an… |