Product by Apache Software Foundation

    Apache Roller

    24 known vulnerabilities in Apache Roller (Apache Software Foundation), 0 of them actively exploited (CISA KEV).

    Key figures

    24

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Apache Roller (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    CriticalCVE-2018-17198

    Apache Roller: Server-Side Request Forgery (SSRF)

    		9.8
    CriticalCVE-2026-82384

    Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

    		9.8
    HighCVE-2021-33580

    regex injection leading to DoS

    		7.5
    CriticalCVE-2026-82377

    Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

    		9.9
    HighCVE-2025-24859

    Apache Roller: Insufficient Session Expiration on Password Change

    		8.8
    CriticalCVE-2026-82378

    Apache Roller: OAuth authorization endpoint trusts request-supplied identity

    		9.0
    HighCVE-2026-82383

    Apache Roller: Anonymous setup action allows frontpage configuration tampering

    		8.2
    HighCVE-2026-82379

    Apache Roller: WSSE digest authentication headers can be replayed

    		7.7
    HighCVE-2026-82348

    Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

    		7.7
    HighCVE-2026-82375

    Apache Roller: Server-side request forgery via entry trackback and enclosure URLs

    		7.4
    HighCVE-2026-82380

    Apache Roller: CSRF protection bypass via self-generated salt validation

    		8.1
    HighCVE-2026-82376

    Apache Roller: XML external entity processing in trackback response parser

    		7.7
    HighCVE-2026-82386

    Apache Roller: XML external entity processing in OPML bookmark import

    		7.7
    MediumCVE-2026-91204

    Apache Roller: Stored javascript: URI in HTML comments

    		6.1
    MediumCVE-2026-91206

    Apache Roller: Reflected XSS in the optional LDAP comment authenticator

    		6.1
    MediumCVE-2026-86507

    Apache Roller: Stored XSS in comment moderation via comment author URL

    		6.1
    MediumCVE-2023-37581

    Apache Roller: Cross-site Scripting

    		5.4
    MediumCVE-2026-82385

    Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

    		6.5
    MediumCVE-2026-82546

    Apache Roller: Stored cross-site scripting through incoming Trackback links

    		6.1
    MediumCVE-2026-82382

    Apache Roller: Reflected cross-site scripting in the frontpage directory parameter

    		6.1
    MediumCVE-2026-82381

    Apache Roller: Stored cross-site scripting in the authoring UI

    		5.4
    MediumCVE-2026-82387

    Apache Roller: Stored cross-site scripting via uploaded media content type

    		5.4
    MediumCVE-2024-25090

    Apache Roller: Cross-site Scripting

    		5.4
    MediumCVE-2024-46911

    Apache Roller: Weakness in CSRF protection allows privilege escalation

    		4.7

    All products by Apache Software Foundation