What’s Vulnerable › Products
intranda goobi-viewer-core vulnerabilities
16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your intranda goobi-viewer-core version is affected
Latest intranda goobi-viewer-core vulnerabilities
- CVE-2026-55486 — Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS (CVSS 9.3)
- CVE-2026-55465 — Goobi viewer: Solr injection via unvalidated region parameter in spatial search (CVSS 5.3)
- CVE-2026-55463 — Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation (CVSS 6.5)
- CVE-2026-55459 — Goobi viewer: OpenID JWT audience not enforced by the verifier (CVSS 7.4)
- CVE-2026-55457 — Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass (CVSS 7.4)
- CVE-2026-55444 — Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters (CVSS 5.3)
- CVE-2026-46652 — Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer (CVSS 9.8)
- CVE-2026-46651 — Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer (CVSS 9.8)
- CVE-2026-46347 — Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset (CVSS 6.8)
- CVE-2026-46346 — Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset (CVSS 6.5)
- CVE-2026-55442 — Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection (CVSS 5.3)
- CVE-2026-45083 — Goobi viewer: Unauthenticated Solr Streaming Expression Proxy (CVSS 9.8)
- CVE-2023-29016 — Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames (CVSS 6.1)
- CVE-2023-29015 — Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments (CVSS 6.1)
- CVE-2023-29014 — Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter (CVSS 6.1)
- CVE-2020-15124 — Path traversal in Goobi viewer Core (CVSS 6.5)