agentprime: apache-software-foundation-apache-syncopeEvery new CVE for apache-software-foundation-apache-syncope.https://agentprime.io/CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events searchhttps://agentprime.io/advisories/CVE-2026-114364/https://agentprime.io/advisories/CVE-2026-114364/Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 13:12:27 GMTCVECVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypasshttps://agentprime.io/advisories/CVE-2026-113687/https://agentprime.io/advisories/CVE-2026-113687/Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 13:10:11 GMTCVECVE-2026-113511: Apache Syncope: Delegated administration boundaries can be bypassed for Realm updatehttps://agentprime.io/advisories/CVE-2026-113511/https://agentprime.io/advisories/CVE-2026-113511/Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 13:08:12 GMTCVECVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service updatehttps://agentprime.io/advisories/CVE-2026-110535/https://agentprime.io/advisories/CVE-2026-110535/Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 13:06:00 GMTCVECVE-2026-109083: Apache Syncope: Remote Code Execution via Flowable JUEL expressionhttps://agentprime.io/advisories/CVE-2026-109083/https://agentprime.io/advisories/CVE-2026-109083/Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 13:04:15 GMTCVECVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headershttps://agentprime.io/advisories/CVE-2026-73191/https://agentprime.io/advisories/CVE-2026-73191/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 13:24:22 GMTCVECVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injectionhttps://agentprime.io/advisories/CVE-2026-73195/https://agentprime.io/advisories/CVE-2026-73195/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 13:23:47 GMTCVECVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administrationhttps://agentprime.io/advisories/CVE-2026-73236/https://agentprime.io/advisories/CVE-2026-73236/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 13:23:17 GMTCVECVE-2026-73370: Apache Syncope: Cross-Realm boundaries reconciliation bypasshttps://agentprime.io/advisories/CVE-2026-73370/https://agentprime.io/advisories/CVE-2026-73370/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 13:07:58 GMTCVEcriticalCVE-2026-73178: Apache Syncope: JWT Access Token takeoverhttps://agentprime.io/advisories/CVE-2026-73178/https://agentprime.io/advisories/CVE-2026-73178/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 13:06:19 GMTCVECVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roleshttps://agentprime.io/advisories/CVE-2026-73470/https://agentprime.io/advisories/CVE-2026-73470/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:58:51 GMTCVEcriticalCVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictionshttps://agentprime.io/advisories/CVE-2026-73579/https://agentprime.io/advisories/CVE-2026-73579/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:56:31 GMTCVEcriticalCVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readablehttps://agentprime.io/advisories/CVE-2026-75015/https://agentprime.io/advisories/CVE-2026-75015/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:55:27 GMTCVECVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioninghttps://agentprime.io/advisories/CVE-2026-75030/https://agentprime.io/advisories/CVE-2026-75030/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:54:22 GMTCVEcriticalCVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events searchhttps://agentprime.io/advisories/CVE-2026-77051/https://agentprime.io/advisories/CVE-2026-77051/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:52:49 GMTCVEcriticalCVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration valueshttps://agentprime.io/advisories/CVE-2026-73668/https://agentprime.io/advisories/CVE-2026-73668/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:51:46 GMTCVEcriticalCVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgshttps://agentprime.io/advisories/CVE-2026-77147/https://agentprime.io/advisories/CVE-2026-77147/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:49:41 GMTCVECVE-2026-77181: Apache Syncope: ClientApp update entitlement not effectivehttps://agentprime.io/advisories/CVE-2026-77181/https://agentprime.io/advisories/CVE-2026-77181/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:48:01 GMTCVEcriticalCVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylisthttps://agentprime.io/advisories/CVE-2026-77883/https://agentprime.io/advisories/CVE-2026-77883/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:30:53 GMTCVECVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduserhttps://agentprime.io/advisories/CVE-2026-78318/https://agentprime.io/advisories/CVE-2026-78318/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:29:34 GMTCVECVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authenticationhttps://agentprime.io/advisories/CVE-2026-78330/https://agentprime.io/advisories/CVE-2026-78330/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:24:56 GMTCVEcriticalCVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated userhttps://agentprime.io/advisories/CVE-2026-78336/https://agentprime.io/advisories/CVE-2026-78336/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 12:23:51 GMTCVECVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task searchhttps://agentprime.io/advisories/CVE-2026-82232/https://agentprime.io/advisories/CVE-2026-82232/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:45:44 GMTCVEcriticalCVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistencehttps://agentprime.io/advisories/CVE-2026-86460/https://agentprime.io/advisories/CVE-2026-86460/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:43:58 GMTCVEcriticalCVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log outputhttps://agentprime.io/advisories/CVE-2026-87779/https://agentprime.io/advisories/CVE-2026-87779/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:42:56 GMTCVECVE-2026-87785: Apache Syncope: JWT subject spoofinghttps://agentprime.io/advisories/CVE-2026-87785/https://agentprime.io/advisories/CVE-2026-87785/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:38:12 GMTCVEcriticalCVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypasshttps://agentprime.io/advisories/CVE-2026-87802/https://agentprime.io/advisories/CVE-2026-87802/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 10:22:29 GMTCVEcriticalCVE-2026-62418: Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources checkhttps://agentprime.io/advisories/CVE-2026-62418/https://agentprime.io/advisories/CVE-2026-62418/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 14:27:04 GMTCVECVE-2026-62183: Apache Syncope: User self-service privilege escalationhttps://agentprime.io/advisories/CVE-2026-62183/https://agentprime.io/advisories/CVE-2026-62183/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 14:23:20 GMTCVEcriticalCVE-2026-57308: Apache Syncope: SQL injection vulnerability in Audit Events searchhttps://agentprime.io/advisories/CVE-2026-57308/https://agentprime.io/advisories/CVE-2026-57308/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 14:21:57 GMTCVEcriticalCVE-2026-53421: Apache Syncope: Remote Code Execution via Scripted Connectorhttps://agentprime.io/advisories/CVE-2026-53421/https://agentprime.io/advisories/CVE-2026-53421/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 14:21:10 GMTCVEcriticalCVE-2026-53405: Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTaskhttps://agentprime.io/advisories/CVE-2026-53405/https://agentprime.io/advisories/CVE-2026-53405/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 14:20:06 GMTCVEcriticalCVE-2026-63071: Apache Syncope: RCE via Groovy Sandbox bypasshttps://agentprime.io/advisories/CVE-2026-63071/https://agentprime.io/advisories/CVE-2026-63071/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 14:19:19 GMTCVEcritical