# intranda goobi-viewer-core.

Every CVE that names intranda goobi-viewer-core among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS](https://agentprime.io/advisories/CVE-2026-55486.md)
  `CVE-2026-55486` · CVE record: intranda goobi-viewer-core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS), Other injection, Code injection
- [Goobi viewer: Solr injection via unvalidated region parameter in spatial search](https://agentprime.io/advisories/CVE-2026-55465.md)
  `CVE-2026-55465` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection, Other injection
- [Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation](https://agentprime.io/advisories/CVE-2026-55463.md)
  `CVE-2026-55463` · CVE record: intranda goobi-viewer-core · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-1385
- [Goobi viewer: OpenID JWT audience not enforced by the verifier](https://agentprime.io/advisories/CVE-2026-55459.md)
  `CVE-2026-55459` · CVE record: intranda goobi-viewer-core · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-345
- [Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass](https://agentprime.io/advisories/CVE-2026-55457.md)
  `CVE-2026-55457` · CVE record: intranda goobi-viewer-core · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-1392
- [Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters](https://agentprime.io/advisories/CVE-2026-55444.md)
  `CVE-2026-55444` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection, Other injection, CWE-20
- [Path traversal via HTTP \`Content-Disposition\` header in ExternalFilesDownloader enables remote code execution in Goobi viewer](https://agentprime.io/advisories/CVE-2026-46652.md)
  `CVE-2026-46652` · CVE record: intranda goobi-viewer-core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer](https://agentprime.io/advisories/CVE-2026-46651.md)
  `CVE-2026-46651` · CVE record: intranda goobi-viewer-core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Information disclosure, Server-side request forgery (SSRF)
- [Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset](https://agentprime.io/advisories/CVE-2026-46347.md)
  `CVE-2026-46347` · CVE record: intranda goobi-viewer-core · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-340, CWE-640
- [Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset](https://agentprime.io/advisories/CVE-2026-46346.md)
  `CVE-2026-46346` · CVE record: intranda goobi-viewer-core · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-340, CWE-640
- [Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection](https://agentprime.io/advisories/CVE-2026-55442.md)
  `CVE-2026-55442` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-116
- [Path traversal in Goobi viewer Core](https://agentprime.io/advisories/CVE-2020-15124.md)
  `CVE-2020-15124` · CVE record: intranda goobi-viewer-core · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2020 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=intranda-goobi-viewer-core>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/intranda-goobi-viewer-core/>. Everything for agents: <https://agentprime.io/llms.txt>.