CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (Oct 26, 2026, 6:40 AM ET )
This week: 4,026 CVEs published, 328 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 4,026 Show in the list Critical, last 7 days 328 Show in the list Healthcare-tagged, last 7 days 8 Show in the list Known exploited (CISA KEV) 1,756 Show in the list Showing CVEs that name the product apache_software_foundation:apache_syncope . Show all products
34 CVEs, showing 1 to 34
CVE Severity Title Published CVE-2026-73191 Medium 6.1 Apache Syncope: CAS service URL injection via Forwarded HTTP headers Assigned by apache
Sep 14, 2026 CVE-2026-73195 High 7.3 Apache Syncope: CSV export spreadsheet formula injection Assigned by apache
Sep 14, 2026 CVE-2026-73236 High 7.5 Apache Syncope: Cross-Realm authorization bypass in delegated administration Assigned by apache
Sep 14, 2026 CVE-2026-73370 Critical 9.8 Apache Syncope: Cross-Realm boundaries reconciliation bypass Assigned by apache
Sep 14, 2026 CVE-2026-73178 High 7.5 Apache Syncope: JWT Access Token takeover Assigned by apache
Sep 14, 2026 CVE-2026-73470 Critical 9.8 Apache Syncope: Delegating users can grant unowned Roles Assigned by apache
Sep 14, 2026 CVE-2026-73579 Critical 9.8 Apache Syncope: Non-recursive Any search could skip Realms restrictions Assigned by apache
Sep 14, 2026 CVE-2026-75015 Medium 4.9 Apache Syncope: Nested secrets leak cleartext into audit records readable Assigned by apache
Sep 14, 2026 CVE-2026-75030 Critical 9.8 Apache Syncope: Incomplete authorization checks for Group members deprovisioning Assigned by apache
Sep 14, 2026 CVE-2026-77051 Critical 9.8 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search Assigned by apache
Sep 14, 2026 CVE-2026-73668 Critical 9.8 Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values Assigned by apache
Sep 14, 2026 CVE-2026-77147 Medium 6.5 Apache Syncope: Groovy Sandbox escape for empty CommandArgs Assigned by apache
Sep 14, 2026 CVE-2026-77181 Critical 9.8 Apache Syncope: ClientApp update entitlement not effective Assigned by apache
Sep 14, 2026 CVE-2026-77883 Medium 4.9 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist Assigned by apache
Sep 14, 2026 CVE-2026-78318 Medium 6.1 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser Assigned by apache
Sep 14, 2026 CVE-2026-78330 Critical 9.8 Apache Syncope: Privilege escalation for admin user via JWT authentication Assigned by apache
Sep 14, 2026 CVE-2026-78336 High 7.5 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user Assigned by apache
Sep 14, 2026 CVE-2026-82232 Critical 9.8 Apache Syncope: SQL injection via sort parameter in Task search Assigned by apache
Sep 14, 2026 CVE-2026-86460 Critical 9.8 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence Assigned by apache
Sep 14, 2026 CVE-2026-87779 High 7.5 Apache Syncope: AES Secret Key disclosure via log output Assigned by apache
Sep 14, 2026 CVE-2026-87785 Critical 9.1 Apache Syncope: JWT subject spoofing Assigned by apache
Sep 14, 2026 CVE-2026-87802 Critical 9.1 Apache Syncope: SRA OAuth2 JWT signature verification bypass Assigned by apache
Sep 14, 2026 CVE-2026-62418 High 8.1 Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check Assigned by apache
Jul 20, 2026 CVE-2026-62183 Critical 9.8 Apache Syncope: User self-service privilege escalation Assigned by apache
Jul 20, 2026 CVE-2026-57308 Critical 9.8 Apache Syncope: SQL injection vulnerability in Audit Events search Assigned by apache
Jul 20, 2026 CVE-2026-53421 Critical 9.8 Apache Syncope: Remote Code Execution via Scripted Connector Assigned by apache
Jul 20, 2026 CVE-2026-53405 Critical 9.8 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask Assigned by apache
Jul 20, 2026 CVE-2026-63071 Critical 9.8 Apache Syncope: RCE via Groovy Sandbox bypass Assigned by apache
Jul 20, 2026 CVE-2026-42797 Medium 4.9 Apache Syncope: JexlContextBuilder Information Disclosure Assigned by apache
May 25, 2026 CVE-2026-42782 High 7.2 Apache Syncope: Post-auth RCE via Groovy static Assigned by apache
May 25, 2026 CVE-2026-23794 Medium 6.8 Apache Syncope: Reflected XSS on Enduser Login Assigned by apache
Feb 3, 2026 CVE-2026-23795 Medium 4.9 Apache Syncope: Console XXE on Keymaster parameters Assigned by apache
Feb 3, 2026 CVE-2025-65998 High 7.5 Apache Syncope: Default AES key used for internal password encryption Assigned by apache
Nov 24, 2025 CVE-2025-57738 High 7.2 Apache Syncope: Remote Code Execution by delegated administrators Assigned by apache
Oct 20, 2025
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosecsignals.com. Every record links back to the agency that published it.
