Apache Software Foundation Apache Syncope

• CVE-2026-114364 Unrated Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search 0.2%
• CVE-2026-113687 Unrated Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass 0.2%
• CVE-2026-113511 Unrated Apache Syncope: Delegated administration boundaries can be bypassed for Realm update 0.2%
• CVE-2026-110535 Unrated Apache Syncope: AuthProfile value escalation via self-service update 0.3%
• CVE-2026-109083 Unrated Apache Syncope: Remote Code Execution via Flowable JUEL expression 0.2%
• CVE-2026-73191 Medium 6.1 Apache Syncope: CAS service URL injection via Forwarded HTTP headers 0.3%
• CVE-2026-73195 High 7.3 Apache Syncope: CSV export spreadsheet formula injection 0.4%
• CVE-2026-73236 High 7.5 Apache Syncope: Cross-Realm authorization bypass in delegated administration 0.4%
• CVE-2026-73370 Critical 9.8 Apache Syncope: Cross-Realm boundaries reconciliation bypass 0.5%
• CVE-2026-73178 High 7.5 Apache Syncope: JWT Access Token takeover 0.4%
• CVE-2026-73470 Critical 9.8 Apache Syncope: Delegating users can grant unowned Roles 0.5%
• CVE-2026-73579 Critical 9.8 Apache Syncope: Non-recursive Any search could skip Realms restrictions 0.5%
• CVE-2026-75015 Medium 4.9 Apache Syncope: Nested secrets leak cleartext into audit records readable 0.4%
• CVE-2026-75030 Critical 9.8 Apache Syncope: Incomplete authorization checks for Group members deprovisioning 0.6%
• CVE-2026-77051 Critical 9.8 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search 0.6%
• CVE-2026-73668 Critical 9.8 Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values 0.5%
• CVE-2026-77147 Medium 6.5 Apache Syncope: Groovy Sandbox escape for empty CommandArgs 0.4%
• CVE-2026-77181 Critical 9.8 Apache Syncope: ClientApp update entitlement not effective 0.5%
• CVE-2026-77883 Medium 4.9 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist 0.4%
• CVE-2026-78318 Medium 6.1 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser 0.3%
• CVE-2026-78330 Critical 9.8 Apache Syncope: Privilege escalation for admin user via JWT authentication 0.6%
• CVE-2026-78336 High 7.5 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user 0.4%
• CVE-2026-82232 Critical 9.8 Apache Syncope: SQL injection via sort parameter in Task search 0.6%
• CVE-2026-86460 Critical 9.8 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence 0.6%
• CVE-2026-87779 High 7.5 Apache Syncope: AES Secret Key disclosure via log output 0.4%
• CVE-2026-87785 Critical 9.1 Apache Syncope: JWT subject spoofing 0.5%
• CVE-2026-87802 Critical 9.1 Apache Syncope: SRA OAuth2 JWT signature verification bypass 0.3%
• CVE-2026-62418 High 8.1 Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check 0.5%
• CVE-2026-62183 Critical 9.8 Apache Syncope: User self-service privilege escalation 0.7%
• CVE-2026-57308 Critical 9.8 Apache Syncope: SQL injection vulnerability in Audit Events search 0.8%
• CVE-2026-53421 Critical 9.8 Apache Syncope: Remote Code Execution via Scripted Connector 1.1%
• CVE-2026-53405 Critical 9.8 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask 0.7%
• CVE-2026-63071 Critical 9.8 Apache Syncope: RCE via Groovy Sandbox bypass 0.8%
• CVE-2026-42797 Medium 4.9 Apache Syncope: JexlContextBuilder Information Disclosure 0.4%
• CVE-2026-42782 High 7.2 Apache Syncope: Post-auth RCE via Groovy static 0.7%
• CVE-2026-23794 Medium 6.8 Apache Syncope: Reflected XSS on Enduser Login 0.5%
• CVE-2026-23795 Medium 4.9 Apache Syncope: Console XXE on Keymaster parameters 2.0%
• CVE-2025-65998 High 7.5 Apache Syncope: Default AES key used for internal password encryption 0.5%
• CVE-2025-57738 High 7.2 Apache Syncope: Remote Code Execution by delegated administrators 23.2%
• CVE-2024-45031 Medium 6.1 Apache Syncope: Stored XSS in Console and Enduser 0.7%
• CVE-2024-38503 Low 3.9 Apache Syncope: HTML tags can be injected into Console or Enduser text fields 0.7%