Apache Roller (Apache Software Foundation) - vulnerabilities (CVEs)

24 CVEs, 18 in the last 30 days, 5 known versions, newest CVE from 2026-09-28. Vendor: Apache Software Foundation.

CVEs of Apache Roller

• CVE-2026-86507 - CVSS 6.1 (medium), 2026-09-28: Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in…
• CVE-2026-82379 - CVSS 7.7 (high), 2026-09-28: Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain…
• CVE-2026-82380 - CVSS 8.1 (high), 2026-09-28: Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the…
• CVE-2026-82381 - CVSS 5.4 (medium), 2026-09-28: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to…
• CVE-2026-82382 - CVSS 6.1 (medium), 2026-09-28: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected…
• CVE-2026-82383 - CVSS 8.2 (high), 2026-09-28: Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global…
• CVE-2026-82384 - CVSS 9.8 (critical), 2026-09-28: Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes,…
• CVE-2026-82375 - CVSS 7.4 (high), 2026-09-28: Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests…
• CVE-2026-82376 - CVSS 7.7 (high), 2026-09-28: Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse…
• CVE-2026-82377 - CVSS 9.9 (critical), 2026-09-28: Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the…
• CVE-2026-82378 - CVSS 9 (critical), 2026-09-28: Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding…
• CVE-2026-82385 - CVSS 6.5 (medium), 2026-09-28: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath,…
• CVE-2026-82386 - CVSS 7.7 (high), 2026-09-28: Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and…
• CVE-2026-82348 - CVSS 7.7 (high), 2026-09-28: Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or…
• CVE-2026-82387 - CVSS 5.4 (medium), 2026-09-28: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store…
• CVE-2026-82546 - CVSS 6.1 (medium), 2026-09-28: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store…
• CVE-2026-91204 - CVSS 6.1 (medium), 2026-09-28: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a…
• CVE-2026-91206 - CVSS 6.1 (medium), 2026-09-28: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected…
• CVE-2025-24859 - CVSS 8.8 (high), 2025-04-14: A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password…
• CVE-2024-46911 - CVSS 4.7 (medium), 2024-10-14: Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are…
• CVE-2024-25090 - CVSS 5.4 (medium), 2024-07-26: Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache…
• CVE-2023-37581 - CVSS 5.4 (medium), 2023-08-06: Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms…
• CVE-2021-33580 - CVSS 7.5 (high), 2021-08-18: User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The…
• CVE-2018-17198 - CVSS 9.8 (critical), 2019-05-28: Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser…