Vendor
Opencast
21 known vulnerabilities in products by Opencast, 0 of them actively exploited (CISA KEV).
Key figures
21
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2021-43821 | Files Accessible to External Parties in Opencast | 9.9 | |
| High | CVE-2017-1000217 | Opencast: Code Execution | 8.8 | |
| High | CVE-2026-77614 | Opencast: Session fixation in login enables account takeover via crafted link | 8.8 | |
| High | CVE-2026-77615 | Paella Player: Stored XSS via caption cue text | 8.7 | |
| Critical | CVE-2020-5206 | Authentication Bypass For Endpoints With Anonymous Access in OpenCast | 8.7 | |
| High | CVE-2021-43807 | HTTP Method Spoofing in Opencast | 7.5 | |
| High | CVE-2021-32623 | Opencast vulnerable to billion laughs attack (XML bomb) | 8.1 | |
| High | CVE-2020-5230 | Opencast uses unsafe identifiers | 7.7 | |
| High | CVE-2020-5228 | Opencast allows unauthorized public access via OAI-PMH | 7.6 | |
| High | CVE-2024-52797 | Searching Opencast may cause a denial of service | 6.5 | |
| High | CVE-2020-5222 | Hard-Coded Key Used For Remember-me Token in OpenCast | 6.8 | |
| High | CVE-2020-5229 | Opencast stores passwords using outdated MD5 hash algorithm | 7.7 | |
| Medium | CVE-2025-54380 | Opencast still publishes global system account credentials | 6.5 | |
| Medium | CVE-2021-21318 | Removing access may not effect published series | 5.4 | |
| Medium | CVE-2022-29237 | Limited Authentication Bypass for Media Files in Opencast | 5.4 | |
| Medium | CVE-2025-55202 | Opencast has a partial path traversal vulnerability in UI config | 5.3 | |
| Medium | CVE-2020-5231 | Opencast users with ROLE_COURSE_ADMIN can create new users | 4.8 | |
| Medium | CVE-2025-61788 | Opencast Paella Player 7 vulnerable to Cross-Site-Scripting | 5.4 | |
| Medium | CVE-2022-41965 | Opencast Authenticated OpenRedirect Vulnerability | 5.7 | |
| Medium | CVE-2025-61906 | Opencast's editor accidentally publishes videos/overwrites publications #1626 | 4.3 | |
| Medium | CVE-2020-26234 | Disabled Hostname Verification in OpenCast | 4.8 |
Products
| Opencast | 21 | 0 |