Advisories · Technology

Apache Software Foundation Apache Roller.

Every CVE that names Apache Software Foundation Apache Roller among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-86507 CVE record

CVSS 6.1 Medium

Apache Roller: Stored XSS in comment moderation via comment author URL
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
Not analysed yet 28 Sept 2026
CVE-2026-82379 CVE record

CVSS 7.7 High

Apache Roller: WSSE digest authentication headers can be replayed
- Apache Software Foundation Apache Roller
- Authentication bypass
Not analysed yet 28 Sept 2026
CVE-2026-82380 CVE record

CVSS 8.1 High

Apache Roller: CSRF protection bypass via self-generated salt validation
- Apache Software Foundation Apache Roller
- Cross-site request forgery (CSRF)
Not analysed yet 28 Sept 2026
CVE-2026-82381 CVE record

CVSS 5.4 Medium

Apache Roller: Stored cross-site scripting in the authoring UI
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
Not analysed yet 28 Sept 2026
CVE-2026-82382 CVE record

CVSS 6.1 Medium

Apache Roller: Reflected cross-site scripting in the frontpage directory parameter
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
Not analysed yet 28 Sept 2026
CVE-2026-82383 CVE record

CVSS 8.2 High

Apache Roller: Anonymous setup action allows frontpage configuration tampering
- Apache Software Foundation Apache Roller
- Authentication bypass
Not analysed yet 28 Sept 2026
CVE-2026-82384 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
- Apache Software Foundation Apache Roller
- Insecure deserialization
Not analysed yet 28 Sept 2026
CVE-2026-82375 CVE record

CVSS 7.4 High

Apache Roller: Server-side request forgery via entry trackback and enclosure URLs
- Apache Software Foundation Apache Roller
- Server-side request forgery (SSRF)
Not analysed yet 28 Sept 2026
CVE-2026-82376 CVE record

CVSS 7.7 High

Apache Roller: XML external entity processing in trackback response parser
- Apache Software Foundation Apache Roller
- XML external entities (XXE)
Not analysed yet 28 Sept 2026
CVE-2026-82377 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
- Apache Software Foundation Apache Roller
- Broken access control
Not analysed yet 28 Sept 2026
CVE-2026-82378 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Apache Roller: OAuth authorization endpoint trusts request-supplied identity
- Apache Software Foundation Apache Roller
- Broken access control
Not analysed yet 28 Sept 2026
CVE-2026-82385 CVE record

CVSS 6.5 Medium

Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files
- Apache Software Foundation Apache Roller
- Information disclosure
Not analysed yet 28 Sept 2026
CVE-2026-82386 CVE record

CVSS 7.7 High

Apache Roller: XML external entity processing in OPML bookmark import
- Apache Software Foundation Apache Roller
- XML external entities (XXE)
Not analysed yet 28 Sept 2026
CVE-2026-82348 CVE record

CVSS 7.7 High

Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups
- Apache Software Foundation Apache Roller
- Broken access control
Not analysed yet 28 Sept 2026
CVE-2026-82387 CVE record

CVSS 5.4 Medium

Apache Roller: Stored cross-site scripting via uploaded media content type
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
Not analysed yet 28 Sept 2026
CVE-2026-82546 CVE record

CVSS 6.1 Medium

Apache Roller: Stored cross-site scripting through incoming Trackback links
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
Not analysed yet 28 Sept 2026
CVE-2026-91204 CVE record

CVSS 6.1 Medium

Apache Roller: Stored javascript: URI in HTML comments
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
Not analysed yet 28 Sept 2026
CVE-2026-91206 CVE record

CVSS 6.1 Medium

Apache Roller: Reflected XSS in the optional LDAP comment authenticator
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
Not analysed yet 28 Sept 2026
CVE-2025-24859 CVE record

CVSS 2.1 Low

Apache Roller: Insufficient Session Expiration on Password Change
- Apache Software Foundation Apache Roller
- Authentication bypass
Not analysed yet 14 Apr 2025
CVE-2024-46911 CVE record

CVSS 4.7 Medium

Apache Roller: Weakness in CSRF protection allows privilege escalation
- Apache Software Foundation Apache Roller
- Cross-site request forgery (CSRF)
Not analysed yet 14 Oct 2024
CVE-2024-25090 CVE record

CVSS 5.4 Medium

Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
- CWE-20
Not analysed yet 26 Jul 2024
CVE-2023-37581 CVE record

Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller s…
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
Not analysed yet 6 Aug 2023
CVE-2021-33580 CVE record

regex injection leading to DoS
- Apache Software Foundation Apache Roller
- Denial of service
Not analysed yet 18 Aug 2021
CVE-2018-17198 CVE record

Apache Software Foundation Apache Roller: Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller…
- Apache Software Foundation Apache Roller
Not analysed yet 28 May 2019