agentprime: intranda-goobi-viewer-coreEvery new CVE for intranda-goobi-viewer-core.https://agentprime.io/CVE-2026-55486: Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSShttps://agentprime.io/advisories/CVE-2026-55486/https://agentprime.io/advisories/CVE-2026-55486/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:17:42 GMTCVEcriticalCVE-2026-55465: Goobi viewer: Solr injection via unvalidated region parameter in spatial searchhttps://agentprime.io/advisories/CVE-2026-55465/https://agentprime.io/advisories/CVE-2026-55465/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:17:27 GMTCVECVE-2026-55463: Goobi viewer: WebSocket endpoints lack server-side authentication and origin validationhttps://agentprime.io/advisories/CVE-2026-55463/https://agentprime.io/advisories/CVE-2026-55463/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:17:06 GMTCVECVE-2026-55459: Goobi viewer: OpenID JWT audience not enforced by the verifierhttps://agentprime.io/advisories/CVE-2026-55459/https://agentprime.io/advisories/CVE-2026-55459/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:16:44 GMTCVECVE-2026-55457: Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypasshttps://agentprime.io/advisories/CVE-2026-55457/https://agentprime.io/advisories/CVE-2026-55457/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:16:27 GMTCVECVE-2026-55444: Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parametershttps://agentprime.io/advisories/CVE-2026-55444/https://agentprime.io/advisories/CVE-2026-55444/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:16:16 GMTCVECVE-2026-46652: Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerhttps://agentprime.io/advisories/CVE-2026-46652/https://agentprime.io/advisories/CVE-2026-46652/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:15:46 GMTCVEcriticalCVE-2026-46651: Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerhttps://agentprime.io/advisories/CVE-2026-46651/https://agentprime.io/advisories/CVE-2026-46651/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:15:28 GMTCVEcriticalCVE-2026-46347: Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Resethttps://agentprime.io/advisories/CVE-2026-46347/https://agentprime.io/advisories/CVE-2026-46347/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:14:51 GMTCVECVE-2026-46346: Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Resethttps://agentprime.io/advisories/CVE-2026-46346/https://agentprime.io/advisories/CVE-2026-46346/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:14:39 GMTCVECVE-2026-55442: Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injectionhttps://agentprime.io/advisories/CVE-2026-55442/https://agentprime.io/advisories/CVE-2026-55442/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:14:26 GMTCVECVE-2020-15124: Path traversal in Goobi viewer Corehttps://agentprime.io/advisories/CVE-2020-15124/https://agentprime.io/advisories/CVE-2020-15124/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jul 2020 17:35:13 GMTCVEcritical