SY
Product
Syncope
24
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 7Medium 8Low 0
Watch
Add Syncope to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-62418 | 8.1 | Jul 20 | Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2025-65998 | 7.5 | Nov 24 | Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option Affected: 2.1.0 through 2.1.14; 3.0.0 before 3.0.15; 4.0.0 before 4.0.3 |
| CVE-2026-42782 | 7.2 | May 25 | Apache Syncope: Post-auth RCE via Groovy static Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2025-57738 | 7.2 | Oct 20 | Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such… Affected: 2.1.0 before 3.0.14; 4.0.0 before 4.0.2 |
| CVE-2020-11977 | 7.2 | Sep 15 | In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform… Affected: 2.1.0 before 2.1.7 |
| CVE-2018-17186 | 7.2 | Nov 6 | An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution Affected: 2.0.0 through 2.0.11; 2.1.0 through 2.1.2 |
| CVE-2018-1321 | 7.2 | Mar 20 | An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also… Affected: 1.2.0 before 1.2.11; 2.0.0 before 2.0.8; 1.0.0; 1.0.4; 1.0.5; 1.0.6; +13 more |
Showing 7