# Apache Software Foundation Apache Roller.

Every CVE that names Apache Software Foundation Apache Roller among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Apache Roller: Stored XSS in comment moderation via comment author URL](https://agentprime.io/advisories/CVE-2026-86507.md)
  `CVE-2026-86507` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Roller: WSSE digest authentication headers can be replayed](https://agentprime.io/advisories/CVE-2026-82379.md)
  `CVE-2026-82379` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Apache Roller: CSRF protection bypass via self-generated salt validation](https://agentprime.io/advisories/CVE-2026-82380.md)
  `CVE-2026-82380` · CVE record: Apache Software Foundation Apache Roller · CVSS 8.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache Roller: Stored cross-site scripting in the authoring UI](https://agentprime.io/advisories/CVE-2026-82381.md)
  `CVE-2026-82381` · CVE record: Apache Software Foundation Apache Roller · CVSS 5.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Roller: Reflected cross-site scripting in the frontpage directory parameter](https://agentprime.io/advisories/CVE-2026-82382.md)
  `CVE-2026-82382` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Roller: Anonymous setup action allows frontpage configuration tampering](https://agentprime.io/advisories/CVE-2026-82383.md)
  `CVE-2026-82383` · CVE record: Apache Software Foundation Apache Roller · CVSS 8.2 High · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint](https://agentprime.io/advisories/CVE-2026-82384.md)
  `CVE-2026-82384` · CVE record: Apache Software Foundation Apache Roller · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Insecure deserialization
- [Apache Roller: Server-side request forgery via entry trackback and enclosure URLs](https://agentprime.io/advisories/CVE-2026-82375.md)
  `CVE-2026-82375` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.4 High · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Apache Roller: XML external entity processing in trackback response parser](https://agentprime.io/advisories/CVE-2026-82376.md)
  `CVE-2026-82376` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: XML external entities (XXE)
- [Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers](https://agentprime.io/advisories/CVE-2026-82377.md)
  `CVE-2026-82377` · CVE record: Apache Software Foundation Apache Roller · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Apache Roller: OAuth authorization endpoint trusts request-supplied identity](https://agentprime.io/advisories/CVE-2026-82378.md)
  `CVE-2026-82378` · CVE record: Apache Software Foundation Apache Roller · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files](https://agentprime.io/advisories/CVE-2026-82385.md)
  `CVE-2026-82385` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure
- [Apache Roller: XML external entity processing in OPML bookmark import](https://agentprime.io/advisories/CVE-2026-82386.md)
  `CVE-2026-82386` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: XML external entities (XXE)
- [Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups](https://agentprime.io/advisories/CVE-2026-82348.md)
  `CVE-2026-82348` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Apache Roller: Stored cross-site scripting via uploaded media content type](https://agentprime.io/advisories/CVE-2026-82387.md)
  `CVE-2026-82387` · CVE record: Apache Software Foundation Apache Roller · CVSS 5.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Roller: Stored cross-site scripting through incoming Trackback links](https://agentprime.io/advisories/CVE-2026-82546.md)
  `CVE-2026-82546` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Roller: Stored javascript: URI in HTML comments](https://agentprime.io/advisories/CVE-2026-91204.md)
  `CVE-2026-91204` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Roller: Reflected XSS in the optional LDAP comment authenticator](https://agentprime.io/advisories/CVE-2026-91206.md)
  `CVE-2026-91206` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Roller: Insufficient Session Expiration on Password Change](https://agentprime.io/advisories/CVE-2025-24859.md)
  `CVE-2025-24859` · CVE record: Apache Software Foundation Apache Roller · CVSS 2.1 Low · Not analysed yet · Published 14 Apr 2025 · Tags: Authentication bypass
- [Apache Roller: Weakness in CSRF protection allows privilege escalation](https://agentprime.io/advisories/CVE-2024-46911.md)
  `CVE-2024-46911` · CVE record: Apache Software Foundation Apache Roller · CVSS 4.7 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Cross-site request forgery (CSRF)
- [Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode](https://agentprime.io/advisories/CVE-2024-25090.md)
  `CVE-2024-25090` · CVE record: Apache Software Foundation Apache Roller · CVSS 5.4 Medium · Not analysed yet · Published 26 Jul 2024 · Tags: Cross-site scripting (XSS), CWE-20
- [Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller s…](https://agentprime.io/advisories/CVE-2023-37581.md)
  `CVE-2023-37581` · CVE record: Apache Software Foundation Apache Roller · No CVSS score · Not analysed yet · Published 6 Aug 2023 · Tags: Cross-site scripting (XSS)
- [regex injection leading to DoS](https://agentprime.io/advisories/CVE-2021-33580.md)
  `CVE-2021-33580` · CVE record: Apache Software Foundation Apache Roller · No CVSS score · Not analysed yet · Published 18 Aug 2021 · Tags: Denial of service
- [Apache Software Foundation Apache Roller: Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller…](https://agentprime.io/advisories/CVE-2018-17198.md)
  `CVE-2018-17198` · CVE record: Apache Software Foundation Apache Roller · No CVSS score · Not analysed yet · Published 28 May 2019

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-roller>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-roller/>. Everything for agents: <https://agentprime.io/llms.txt>.