Apereo Foundation openEQUELLA
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-66092 | 2019.1 – < 2026.2 | Stored XSS in pre-login notice via reachable legacy logon route | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-66091 | 2019.2 – < 2026.1 | Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-66090 | < 2026.1 | XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read | HIGH 7.1 | 0.3 % | ||
| CVE-2026-66089 | < 2026.1 | XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-66088 | < 2026.1 | Unrestricted Command Execution via system.execute | CRITICAL 9.4 | 0.7 % | ||
| CVE-2026-16889 | 2019.1 – < 2026.1 | Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-67615 | < 2026.1.0 | openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker | HIGH 8.7 | 0.5 % |