What’s Vulnerable › Products

Apache Software Foundation Apache Cocoon vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your Apache Software Foundation Apache Cocoon version is affected

Latest Apache Software Foundation Apache Cocoon vulnerabilities

• CVE-2026-108089 — Apache Cocoon: Unauthenticated access to diagnostic interfaces (CVSS 7.5)
• CVE-2026-108088 — Apache Cocoon: Cross-user cache poisoning
• CVE-2026-108087 — Apache Cocoon: SQL Injection
• CVE-2026-108086 — Apache Cocoon: XEE could lead to SSRF and information disclosure
• CVE-2025-24783 — Apache Cocoon: continuations may not be private (CVSS 7.5)
• CVE-2023-49733 — Apache Cocoon's StreamGenerator is vulnerable to XXE injection (CVSS 9.8)
• CVE-2022-45135 — Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction (CVSS 9.8)
• CVE-2020-11991 — (CVSS 7.5)
• CVE-2003-1172 — (CVSS 5.0)