Apache Software Foundation Apache Cocoon

• CVE-2026-108089 High 7.5 Apache Cocoon: Unauthenticated access to diagnostic interfaces 0.5%
• CVE-2026-108088 High 7.5 Apache Cocoon: Cross-user cache poisoning 0.5%
• CVE-2026-108087 High 8.8 Apache Cocoon: SQL Injection 0.4%
• CVE-2026-108086 High 7.5 Apache Cocoon: XEE could lead to SSRF and information disclosure 0.4%
• CVE-2025-24783 High 7.5 Apache Cocoon: continuations may not be private 0.8%
• CVE-2023-49733 Unrated Apache Cocoon's StreamGenerator is vulnerable to XXE injection 1.3%
• CVE-2022-45135 Critical 9.8 Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction 1.1%