What’s Vulnerable › Products

OpenOLAT vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your OpenOLAT version is affected

Latest OpenOLAT vulnerabilities

• CVE-2026-31946 — OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow (CVSS 9.8)
• CVE-2026-28228 — OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution (CVSS 8.8)
• CVE-2024-28198 — XML external entity (XXE) injection in OpenOLAT (CVSS 7.5)
• CVE-2024-25974 — Stored Cross-Site Scripting (XSS) within the Media Center (CVSS 5.4)
• CVE-2024-25973 — Multiple Stored Cross-Site Scripting Vulnerabilities (CVSS 5.4)
• CVE-2021-41242 — Path Traversal in some REST methods leading to file upload to arbitrary places (CVSS 8.1)
• CVE-2021-41152 — Path Traversal in Folder Component Leading to Local File Inclusion (CVSS 7.7)
• CVE-2021-39181 — Unsafe Deserialization of User Data Using XStream (CVSS 6.5)
• CVE-2021-39180 — Path Traversal in Archive Handling Leading to Code Execution (CVSS 8.8)