Apache Software Foundation Apache Roller

• CVE-2026-86507 Medium 6.1 Apache Roller: Stored XSS in comment moderation via comment author URL 0.3%
• CVE-2026-82379 High 7.7 Apache Roller: WSSE digest authentication headers can be replayed 0.4%
• CVE-2026-82380 High 8.1 Apache Roller: CSRF protection bypass via self-generated salt validation 0.2%
• CVE-2026-82381 Medium 5.4 Apache Roller: Stored cross-site scripting in the authoring UI 0.2%
• CVE-2026-82382 Medium 6.1 Apache Roller: Reflected cross-site scripting in the frontpage directory parameter 0.3%
• CVE-2026-82383 High 8.2 Apache Roller: Anonymous setup action allows frontpage configuration tampering 0.5%
• CVE-2026-82384 Critical 9.8 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint 1.0%
• CVE-2026-82375 High 7.4 Apache Roller: Server-side request forgery via entry trackback and enclosure URLs 0.3%
• CVE-2026-82376 High 7.7 Apache Roller: XML external entity processing in trackback response parser 0.3%
• CVE-2026-82377 Critical 9.9 Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers 0.4%
• CVE-2026-82378 Critical 9.0 Apache Roller: OAuth authorization endpoint trusts request-supplied identity 0.4%
• CVE-2026-82385 Medium 6.5 Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files 0.3%
• CVE-2026-82386 High 7.7 Apache Roller: XML external entity processing in OPML bookmark import 0.3%
• CVE-2026-82348 High 7.7 Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups 0.3%
• CVE-2026-82387 Medium 5.4 Apache Roller: Stored cross-site scripting via uploaded media content type 0.2%
• CVE-2026-82546 Medium 6.1 Apache Roller: Stored cross-site scripting through incoming Trackback links 0.3%
• CVE-2026-91204 Medium 6.1 Apache Roller: Stored javascript: URI in HTML comments 0.3%
• CVE-2026-91206 Medium 6.1 Apache Roller: Reflected XSS in the optional LDAP comment authenticator 0.3%
• CVE-2025-24859 Low 2.1 Apache Roller: Insufficient Session Expiration on Password Change 1.1%
• CVE-2024-46911 Medium 4.7 Apache Roller: Weakness in CSRF protection allows privilege escalation 0.4%
• CVE-2024-25090 Medium 5.4 Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode 0.8%
• CVE-2023-37581 Unrated Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users. 1.2%
• CVE-2021-33580 Unrated regex injection leading to DoS 3.3%