Apache Cocoon (Apache Software Foundation) - vulnerabilities (CVEs)

7 CVEs, 4 in the last 30 days, 2 known versions, newest CVE from 2026-10-20. Vendor: Apache Software Foundation.

CVEs of Apache Cocoon

• CVE-2026-108089 - CVSS 7.5 (high), 2026-10-20: ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated…
• CVE-2026-108088, 2026-10-20: ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user…
• CVE-2026-108087, 2026-10-20: ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This…
• CVE-2026-108086, 2026-10-20: ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This…
• CVE-2025-24783 - CVSS 7.5 (high), 2025-01-27: ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache…
• CVE-2023-49733 - CVSS 9.8 (critical), 2023-11-30: Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are…
• CVE-2022-45135 - CVSS 9.8 (critical), 2023-11-30: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from…