Login Request a demo
AS
Product
Apache Syncope
by Apache Software Foundation · last CVE Sep 14, 2026
30
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities30In the news0Timeline
Severity mix
Critical 17High 7Medium 6Low 0
Severity
All severities30Critical17High7Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Syncope to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-77147
6.5
0%
Sep 14
Apache Syncope: Groovy Sandbox escape for empty CommandArgs
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-73191
6.1
0%
Sep 14
Apache Syncope: CAS service URL injection via Forwarded HTTP headers
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-78318
6.1
0%
Sep 14
Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
Affected: 4.0.4 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-75015
4.9
0%
Sep 14
Apache Syncope: Nested secrets leak cleartext into audit records readable
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-77883
4.9
0%
Sep 14
Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist
Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2
CVE-2026-42797
4.9
0%
May 25
Apache Syncope: JexlContextBuilder Information Disclosure
Affected: 3.0 through 3.0.16; 4.0 through 4.0.5; 4.1 through 4.1.0
Showing 6