Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-82427 | high | 7.8 | No | Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That... | 2026-09-14 |
| CVE-2026-82426 | medium | 6.5 | No | Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and ope... | 2026-09-14 |
| CVE-2026-84179 | medium | 6.5 | No | Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result withou... | 2026-09-14 |
| CVE-2026-82441 | critical | 9.1 | No | Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills... | 2026-09-14 |
| CVE-2026-82439 | critical | 9.8 | No | Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No... | 2026-09-14 |
| CVE-2026-73370 | critical | 9.8 | No | Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pul... | 2026-09-14 |
| CVE-2026-73236 | high | 7.5 | No | Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced... | 2026-09-14 |
| CVE-2026-73195 | high | 7.3 | No | Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one... | 2026-09-14 |
| CVE-2026-73191 | medium | 6.1 | No | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authenticat... | 2026-09-14 |
| CVE-2026-78336 | high | 7.5 | No | Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of availab... | 2026-09-14 |
| CVE-2026-78330 | critical | 9.8 | No | Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are discl... | 2026-09-14 |
| CVE-2026-78318 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope. The notification mess... | 2026-09-14 |
| CVE-2026-77883 | medium | 4.9 | No | Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Der... | 2026-09-14 |
| CVE-2026-77181 | critical | 9.8 | No | Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the rela... | 2026-09-14 |
| CVE-2026-77147 | medium | 6.5 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for... | 2026-09-14 |
| CVE-2026-77051 | critical | 9.8 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with... | 2026-09-14 |
| CVE-2026-75030 | critical | 9.8 | No | Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provisio... | 2026-09-14 |
| CVE-2026-75015 | medium | 4.9 | No | Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently... | 2026-09-14 |
| CVE-2026-73668 | critical | 9.8 | No | Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read v... | 2026-09-14 |
| CVE-2026-73579 | critical | 9.8 | No | Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch... | 2026-09-14 |