Log in Start free

DSpace

Products

ProductCVEsExploitedLatest
DSpace15–Sep 2, 2026

Exploited and recent CVEs

  • CVE-2026-49832 High 8.0 DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN 0.9%
  • CVE-2026-49833 Medium 5.5 DSpace: Path Traversal possible in LDN message generation 0.4%
  • CVE-2026-49831 Medium 5.5 DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability) 0.5%
  • CVE-2026-49830 Medium 4.4 DSpace: ORE resource URI does not validate scheme for non-web resources 0.5%
  • CVE-2025-53622 Medium 5.2 DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file 0.5%
  • CVE-2025-53621 Medium 6.9 DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources 0.4%
  • CVE-2024-38364 Low 2.6 DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document 0.4%
  • CVE-2022-31195 High 7.2 Path traversal vulnerability in Simple Archive Format package import in DSpace 2.0%
  • CVE-2022-31192 High 7.1 Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature 0.8%
  • CVE-2022-31191 High 7.1 Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools 0.8%
  • CVE-2022-31194 High 8.2 Path traversal vulnerabilities in DSpace JSPUI submission upload 1.5%
  • CVE-2022-31193 High 7.1 URL Redirection to Untrusted Site in Dspace JSPUI 0.9%
  • CVE-2022-31189 Medium 5.3 "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization 0.7%
  • CVE-2022-31190 Medium 5.3 Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI 0.9%
  • CVE-2021-41189 High 7.2 Communities and collections administrators can escalate their privilege up to system administrator 2.1%