Apereo Foundation openEQUELLA

• CVE-2026-66092 Medium 4.8 Stored XSS in pre-login notice via reachable legacy logon route 0.3%
• CVE-2026-66091 Medium 6.9 Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details 0.4%
• CVE-2026-66090 High 7.1 XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read 0.3%
• CVE-2026-66089 Medium 6.1 XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion 0.3%
• CVE-2026-66088 Critical 9.4 Unrestricted Command Execution via system.execute 0.7%
• CVE-2026-16889 Medium 4.8 Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin 0.3%
• CVE-2026-67615 High 8.8 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker 0.5%