What’s Vulnerable › Products

Apereo Foundation openEQUELLA vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Apereo Foundation openEQUELLA version is affected

Latest Apereo Foundation openEQUELLA vulnerabilities

• CVE-2026-66092 — Stored XSS in pre-login notice via reachable legacy logon route (CVSS 4.8)
• CVE-2026-66091 — Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details (CVSS 6.9)
• CVE-2026-66090 — XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read (CVSS 7.1)
• CVE-2026-66089 — XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion (CVSS 6.1)
• CVE-2026-66088 — Unrestricted Command Execution via system.execute (CVSS 9.4)
• CVE-2026-16889 — Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin (CVSS 4.8)
• CVE-2026-67615 — openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker (CVSS 8.8)