OOpenOLAT

Products

Exploited and recent CVEs

• CVE-2026-28228 High 8.8 OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution 0.4%
• CVE-2026-31946 Critical 9.8 OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow 0.2%
• CVE-2024-28198 Medium 4.6 XML external entity (XXE) injection in OpenOLAT 0.4%
• CVE-2021-41242 High 8.1 Path Traversal in some REST methods leading to file upload to arbitrary places 1.5%
• CVE-2021-41152 High 7.7 Path Traversal in Folder Component Leading to Local File Inclusion 1.2%
• CVE-2021-39181 High 8.8 Unsafe Deserialization of User Data Using XStream 1.9%
• CVE-2021-39180 High 8.1 Path Traversal in Archive Handling Leading to Code Execution 2.4%