Login Request a demo
SY
Product
Syncope
by Apache · last CVE Jul 20, 2026
24
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities24In the news0Timeline
Severity mix
Critical 7High 7Medium 8Low 0
Severity
All severities24Critical7High7Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Syncope to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-62183
9.8
1%
Jul 20
Apache Syncope: User self-service privilege escalation
Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2
CVE-2026-57308
9.8
1%
Jul 20
Apache Syncope: SQL injection vulnerability in Audit Events search
Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2
CVE-2026-53421
9.8
1%
Jul 20
Apache Syncope: Remote Code Execution via Scripted Connector
Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2
CVE-2026-53405
9.8
1%
Jul 20
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2
CVE-2026-63071
9.8
1%
Jul 20
Apache Syncope: RCE via Groovy Sandbox bypass
Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2
CVE-2020-1961
9.8
5%
May 4
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject…
Affected: 2.0.0 before 2.0.15; 2.1.0 before 2.1.6
CVE-2020-1959
9.8
5%
May 4
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote…
Affected: 2.1.0 before 2.1.6
Showing 7