What’s Vulnerable › Products

Apache Software Foundation Apache Roller vulnerabilities

32 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your Apache Software Foundation Apache Roller version is affected

Latest Apache Software Foundation Apache Roller vulnerabilities

• CVE-2026-86507 — Apache Roller: Stored XSS in comment moderation via comment author URL (CVSS 6.1)
• CVE-2026-91206 — Apache Roller: Reflected XSS in the optional LDAP comment authenticator (CVSS 6.1)
• CVE-2026-91204 — Apache Roller: Stored javascript: URI in HTML comments (CVSS 6.1)
• CVE-2026-82546 — Apache Roller: Stored cross-site scripting through incoming Trackback links (CVSS 6.1)
• CVE-2026-82387 — Apache Roller: Stored cross-site scripting via uploaded media content type (CVSS 5.4)
• CVE-2026-82386 — Apache Roller: XML external entity processing in OPML bookmark import (CVSS 7.7)
• CVE-2026-82385 — Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files (CVSS 6.5)
• CVE-2026-82384 — Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint (CVSS 9.8)
• CVE-2026-82383 — Apache Roller: Anonymous setup action allows frontpage configuration tampering (CVSS 8.2)
• CVE-2026-82382 — Apache Roller: Reflected cross-site scripting in the frontpage directory parameter (CVSS 6.1)
• CVE-2026-82381 — Apache Roller: Stored cross-site scripting in the authoring UI (CVSS 5.4)
• CVE-2026-82380 — Apache Roller: CSRF protection bypass via self-generated salt validation (CVSS 8.1)
• CVE-2026-82379 — Apache Roller: WSSE digest authentication headers can be replayed (CVSS 7.7)
• CVE-2026-82378 — Apache Roller: OAuth authorization endpoint trusts request-supplied identity (CVSS 9.0)
• CVE-2026-82377 — Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers (CVSS 9.9)
• CVE-2026-82376 — Apache Roller: XML external entity processing in trackback response parser (CVSS 7.7)
• CVE-2026-82375 — Apache Roller: Server-side request forgery via entry trackback and enclosure URLs (CVSS 7.4)
• CVE-2026-82348 — Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups (CVSS 7.7)
• CVE-2025-24859 — Apache Roller: Insufficient Session Expiration on Password Change (CVSS 8.8)
• CVE-2024-46911 — Apache Roller: Weakness in CSRF protection allows privilege escalation (CVSS 4.7)
• CVE-2024-25090 — Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode (CVSS 5.4)
• CVE-2023-37581 — Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users. (CVSS 5.4)
• CVE-2021-33580 — regex injection leading to DoS (CVSS 7.5)
• CVE-2019-0234 — (CVSS 6.1)
• CVE-2018-17198 — (CVSS 9.8)