Vendor

    Apereo Foundation

    8 known vulnerabilities in products by Apereo Foundation, 0 of them actively exploited (CISA KEV).

    Key figures

    8

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Apereo Foundation
    CriticalCVE-2026-66088

    Unrestricted Command Execution via system.execute

    		—
    HighCVE-2026-67615

    openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

    		8.8
    CriticalCVE-2023-4612

    MFA bypass in Apereo CAS

    also in 1 other product

    		9.8
    MediumCVE-2026-66091

    Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details

    		—
    HighCVE-2026-66090

    XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read

    		—
    MediumCVE-2026-66089

    XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion

    		—
    MediumCVE-2026-66092

    Stored XSS in pre-login notice via reachable legacy logon route

    		—
    MediumCVE-2026-16889

    Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin

    		—

    Products

    Products by Apereo Foundation
    Openequella70