Login Request a demo
DS
Product
DSpace
by DSpace · last CVE Sep 2, 2026
14
CVEs
0
On KEV
8.0
Max CVSS
0
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 0High 3Medium 10Low 1
Severity
All severities14Critical0High3Medium10Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add DSpace to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-49832
8.0
1%
Sep 2
DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN
Affected: >= 8.0-rc1, < 8.4; >= 9.0-rc1, < 9.3; = 10-rc1
CVE-2022-31195
7.2
2%
Aug 1
Path traversal vulnerability in Simple Archive Format package import in DSpace
Affected: >= 6.0, < 6.4; >= 4.0, < 5.11
CVE-2022-31194
7.2
1%
Aug 1
Path traversal vulnerabilities in DSpace JSPUI submission upload
Affected: >= 6.0, < 6.4; >= 4.0, < 5.11
CVE-2025-53621
6.9
0%
Jul 15
DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources
Affected: < 7.6.4; >= 8.0, < 8.2; >= 9.0, < 9.1
CVE-2022-31192
6.1
1%
Aug 1
Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature
Affected: >= 6.0, < 6.4; >= 4.0, < 5.11
CVE-2022-31191
6.1
1%
Aug 1
Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools
Affected: >= 6.0, < 6.4; >= 4.0, < 5.11
CVE-2022-31193
6.1
1%
Aug 1
URL Redirection to Untrusted Site in Dspace JSPUI
Affected: >= 6.0, < 6.4; >= 4.0, < 5.11
CVE-2026-49833
5.5
0%
Sep 2
DSpace: Path Traversal possible in LDN message generation
Affected: >= 8.0-rc1, < 8.4; >= 9.0-rc1, < 9.3; = 10-rc1
CVE-2026-49831
5.5
1%
Sep 2
DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)
Affected: < 7.6.7; >= 8.0-rc1, < 8.4; >= 9.0-rc1, < 9.3; = 10-rc1
CVE-2022-31189
5.3
1%
Aug 1
"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization
Affected: >= 4.0, < 6.4
CVE-2022-31190
5.3
1%
Aug 1
Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI
Affected: >= 4.0, < 6.4
CVE-2025-53622
5.2
0%
Jul 15
DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file
Affected: < 7.6.4; >= 8.0, < 8.2; >= 9.0, < 9.1
CVE-2026-49830
4.4
0%
Sep 2
DSpace: ORE resource URI does not validate scheme for non-web resources
Affected: < 7.6.7; >= 8.0-rc1, < 8.4; >= 9.0-rc1, < 9.3; = 10-rc1
CVE-2024-38364
2.6
0%
Jun 25
DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document
Affected: >= 7.0, < 7.6.2
Showing 14