Login Request a demo
AS
Product
Apache Syncope
by Apache Software Foundation · last CVE Sep 14, 2026
30
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities30In the news0Timeline
Severity mix
Critical 17High 7Medium 6Low 0
Severity
All severities30Critical17High7Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Syncope to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-73370
9.8
1%
Sep 14
Apache Syncope: Cross-Realm boundaries reconciliation bypass
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-73470
9.8
1%
Sep 14
Apache Syncope: Delegating users can grant unowned Roles
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-73579
9.8
1%
Sep 14
Apache Syncope: Non-recursive Any search could skip Realms restrictions
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-75030
9.8
1%
Sep 14
Apache Syncope: Incomplete authorization checks for Group members deprovisioning
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-77051
9.8
1%
Sep 14
Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-73668
9.8
1%
Sep 14
Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-77181
9.8
1%
Sep 14
Apache Syncope: ClientApp update entitlement not effective
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-78330
9.8
1%
Sep 14
Apache Syncope: Privilege escalation for admin user via JWT authentication
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-82232
9.8
1%
Sep 14
Apache Syncope: SQL injection via sort parameter in Task search
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-86460
9.8
1%
Sep 14
Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-62183
9.8
1%
Jul 20
Apache Syncope: User self-service privilege escalation
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1
CVE-2026-57308
9.8
1%
Jul 20
Apache Syncope: SQL injection vulnerability in Audit Events search
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1
CVE-2026-53421
9.8
1%
Jul 20
Apache Syncope: Remote Code Execution via Scripted Connector
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1
CVE-2026-53405
9.8
1%
Jul 20
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1
CVE-2026-63071
9.8
1%
Jul 20
Apache Syncope: RCE via Groovy Sandbox bypass
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1
CVE-2026-87785
9.1
1%
Sep 14
Apache Syncope: JWT subject spoofing
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-87802
9.1
0%
Sep 14
Apache Syncope: SRA OAuth2 JWT signature verification bypass
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
Showing 17