Login Request a demo
AS
Product
Apache Syncope
by Apache Software Foundation · last CVE Sep 14, 2026
30
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities30In the news0Timeline
Severity mix
Critical 17High 7Medium 6Low 0
Severity
All severities30Critical17High7Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Syncope to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-62418
8.1
0%
Jul 20
Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1
CVE-2026-73236
7.5
0%
Sep 14
Apache Syncope: Cross-Realm authorization bypass in delegated administration
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-73178
7.5
0%
Sep 14
Apache Syncope: JWT Access Token takeover
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-78336
7.5
0%
Sep 14
Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-87779
7.5
0%
Sep 14
Apache Syncope: AES Secret Key disclosure via log output
Affected: 3.0.15 through 3.0.16; 4.0.3 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-73195
7.3
0%
Sep 14
Apache Syncope: CSV export spreadsheet formula injection
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-42782
7.2
1%
May 25
Apache Syncope: Post-auth RCE via Groovy static
Affected: 3.0 through 3.0.16; 4.0 through 4.0.5; 4.1 through 4.1.0
Showing 7