intranda goobi-viewer-core

• CVE-2026-55486 Critical 9.3 Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS 0.3%
• CVE-2026-55465 Medium 5.3 Goobi viewer: Solr injection via unvalidated region parameter in spatial search 0.3%
• CVE-2026-55463 Medium 6.5 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation 0.1%
• CVE-2026-55459 High 7.4 Goobi viewer: OpenID JWT audience not enforced by the verifier 0.2%
• CVE-2026-55457 High 7.4 Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass 0.3%
• CVE-2026-55444 Medium 5.3 Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters 0.3%
• CVE-2026-46652 Critical 9.8 Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer 0.7%
• CVE-2026-46651 Critical 9.8 Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer 0.4%
• CVE-2026-46347 Medium 6.8 Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset 0.3%
• CVE-2026-46346 Medium 6.5 Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset 0.3%
• CVE-2026-55442 Medium 5.3 Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection 0.3%
• CVE-2026-45083 Critical 9.8 Goobi viewer: Unauthenticated Solr Streaming Expression Proxy 0.4%
• CVE-2023-29016 Medium 6.1 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames 0.4%
• CVE-2023-29015 Medium 6.1 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments 0.4%
• CVE-2023-29014 Medium 6.1 Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter 0.4%
• CVE-2020-15124 Critical 9.6 Path traversal in Goobi viewer Core 1.5%