DS
Vendor
DSpace
14
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-49832 | DS DSpace DSpace | 8.0 | Sep 2 | DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN |
| CVE-2026-49833 | DS DSpace DSpace | 5.5 | Sep 2 | DSpace: Path Traversal possible in LDN message generation |
| CVE-2026-49831 | DS DSpace DSpace | 5.5 | Sep 2 | DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability) |
| CVE-2026-49830 | DS DSpace DSpace | 4.4 | Sep 2 | DSpace: ORE resource URI does not validate scheme for non-web resources |
| CVE-2025-53622 | DS DSpace DSpace | 5.2 | Jul 15 | DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file |
| CVE-2025-53621 | DS DSpace DSpace | 6.9 | Jul 15 | DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources |
| CVE-2024-38364 | DS DSpace DSpace | 2.6 | Jun 25 | DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document |
| CVE-2022-31195 | DS DSpace DSpace | 7.2 | Aug 1 | Path traversal vulnerability in Simple Archive Format package import in DSpace |
| CVE-2022-31192 | DS DSpace DSpace | 6.1 | Aug 1 | Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature |
| CVE-2022-31191 | DS DSpace DSpace | 6.1 | Aug 1 | Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools |
| CVE-2022-31194 | DS DSpace DSpace | 7.2 | Aug 1 | Path traversal vulnerabilities in DSpace JSPUI submission upload |
| CVE-2022-31193 | DS DSpace DSpace | 6.1 | Aug 1 | URL Redirection to Untrusted Site in Dspace JSPUI |
| CVE-2022-31189 | DS DSpace DSpace | 5.3 | Aug 1 | "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization |
| CVE-2022-31190 | DS DSpace DSpace | 5.3 | Aug 1 | Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI |