Product by Apache Software Foundation

    Apache Syncope

    40 known vulnerabilities in Apache Syncope (Apache Software Foundation), 0 of them actively exploited (CISA KEV).

    Key figures

    40

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    17

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Apache Syncope (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    HighCVE-2025-57738

    Apache Syncope: Remote Code Execution by delegated administrators

    		7.2
    HighCVE-2018-1321

    Apache Syncope: Code Execution

    		7.2
    CriticalCVE-2026-53421

    Apache Syncope: Remote Code Execution via Scripted Connector

    		9.8
    MediumCVE-2018-1322

    Apache Syncope: security vulnerability

    		4.9
    CriticalCVE-2026-78330

    Apache Syncope: Privilege escalation for admin user via JWT authentication

    		9.8
    CriticalCVE-2026-57308

    Apache Syncope: SQL injection vulnerability in Audit Events search

    		9.8
    CriticalCVE-2026-75030

    Apache Syncope: Incomplete authorization checks for Group members deprovisioning

    		9.8
    CriticalCVE-2026-77051

    Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search

    		9.8
    CriticalCVE-2026-86460

    Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

    		9.8
    CriticalCVE-2026-82232

    Apache Syncope: SQL injection via sort parameter in Task search

    		9.8
    CriticalCVE-2026-63071

    Apache Syncope: RCE via Groovy Sandbox bypass

    		9.8
    CriticalCVE-2026-53405

    Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask

    		9.8
    HighCVE-2018-17186

    Apache Syncope: Code Execution

    		7.2
    CriticalCVE-2026-62183

    Apache Syncope: User self-service privilege escalation

    		9.8
    CriticalCVE-2026-73370

    Apache Syncope: Cross-Realm boundaries reconciliation bypass

    		9.8
    CriticalCVE-2026-73470

    Apache Syncope: Delegating users can grant unowned Roles

    		9.8
    CriticalCVE-2026-73668

    Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

    		9.8
    CriticalCVE-2026-73579

    Apache Syncope: Non-recursive Any search could skip Realms restrictions

    		9.8
    CriticalCVE-2026-77181

    Apache Syncope: ClientApp update entitlement not effective

    		9.8
    CriticalCVE-2026-87785

    Apache Syncope: JWT subject spoofing

    		9.1
    MediumCVE-2026-23795

    Apache Syncope: Console XXE on Keymaster parameters

    		4.9
    HighCVE-2026-42782

    Apache Syncope: Post-auth RCE via Groovy static

    		7.2
    CriticalCVE-2026-87802

    Apache Syncope: SRA OAuth2 JWT signature verification bypass

    		9.1
    HighCVE-2026-73178

    Apache Syncope: JWT Access Token takeover

    		7.5
    HighCVE-2026-87779

    Apache Syncope: AES Secret Key disclosure via log output

    		7.5

    All vulnerabilities in search

    All products by Apache Software Foundation