Apache Roller
- Software type
- Other
- Total vulnerabilities (90 days)
- 33
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/13/2026, Apache Roller recorded 33 security vulnerabilities in the last 90 days, of which 12 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Roller and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-123374Apache Roller: Deserialization of untrusted data in weblog update ping responsesCVE-2026-122300Apache Roller: Limited weblog members can remove or change published entriesCVE-2026-118414Apache Roller: Stored cross-site scripting through the weblog descriptionCVE-2026-118413Apache Roller: Stored cross-site scripting through imported blogroll linksCVE-2026-118412Apache Roller: Disabled accounts can sign in through OpenID| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-123374Apache Roller: Deserialization of untrusted data in weblog update ping responses | Exploitation statusNot confirmed | FixYes |
| SeverityUnknown |
CVE-2026-122300Apache Roller: Limited weblog members can remove or change published entries | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityUnknown |
|---|
CVE-2026-118414Apache Roller: Stored cross-site scripting through the weblog description | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityMedium |
|---|
CVE-2026-118413Apache Roller: Stored cross-site scripting through imported blogroll links | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityMedium |
|---|
CVE-2026-118412Apache Roller: Disabled accounts can sign in through OpenID | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityLow |
|---|
CVE-2026-118411Apache Roller: Cross-site request forgery through GET requests to administrative actions | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityHigh |
|---|
CVE-2026-118410Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityLow |
|---|
CVE-2026-118409Apache Roller: Commenter email addresses recoverable through public search | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityMedium |
|---|
CVE-2026-118408Apache Roller: Unpublished entries of other weblogs readable through preview | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityLow |
|---|
CVE-2026-118405Apache Roller: Exposure of other users' email addresses through the user search | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityMedium |
|---|
CVE-2026-111824Apache Roller: Stored cross-site scripting through custom-theme resource URLs | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityUnknown |
|---|
CVE-2026-108338Apache Roller: Stored cross-site scripting through AtomPub entry tags | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityUnknown |
|---|
CVE-2026-105154Apache Roller: Cross-site request forgery in Planet administration lets an attacker make the server fetch arbitrary URLs | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityMedium |
|---|
CVE-2026-105153Apache Roller: XML external entity processing in AtomPub entry parsing | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityHigh |
|---|
CVE-2026-105152Apache Roller: Weblog template access to wrapped objects exposes another user's password hash | Exploitation statusNot confirmed | FixYes | Published11/11/2026 | SeverityMedium |
|---|
CVE-2026-91206Apache Roller: Reflected XSS in the optional LDAP comment authenticator | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-91204Apache Roller: Stored javascript: URI in HTML comments | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-86507Apache Roller: Stored XSS in comment moderation via comment author URL | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-82546Apache Roller: Stored cross-site scripting through incoming Trackback links | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-82387Apache Roller: Stored cross-site scripting via uploaded media content type | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-82386Apache Roller: XML external entity processing in OPML bookmark import | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-82385Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-82384Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityCritical |
|---|
CVE-2026-82383Apache Roller: Anonymous setup action allows frontpage configuration tampering | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-82382Apache Roller: Reflected cross-site scripting in the frontpage directory parameter | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-82381Apache Roller: Stored cross-site scripting in the authoring UI | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-82380Apache Roller: CSRF protection bypass via self-generated salt validation | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-82379Apache Roller: WSSE digest authentication headers can be replayed | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-82378Apache Roller: OAuth authorization endpoint trusts request-supplied identity | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityCritical |
|---|
CVE-2026-82377Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityCritical |
|---|
CVE-2026-82376Apache Roller: XML external entity processing in trackback response parser | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-82375Apache Roller: Server-side request forgery via entry trackback and enclosure URLs | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-82348Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2025-24859Apache Roller: Insufficient Session Expiration on Password Change | Exploitation statusNot exploited | FixYes | Published04/14/2025 | SeverityLow |
|---|
CVE-2024-46911Apache Roller: Weakness in CSRF protection allows privilege escalation | Exploitation statusNot exploited | FixYes | Published10/14/2024 | SeverityMedium |
|---|
CVE-2024-25090Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode | Exploitation statusNot exploited | FixYes | Published07/26/2024 | SeverityMedium |
|---|
CVE-2023-37581Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users. | Exploitation statusNot exploited | FixYes | Published08/06/2023 | SeverityUnknown |
|---|
CVE-2021-33580regex injection leading to DoS | Exploitation statusNot confirmed | FixYes | Published08/18/2021 | SeverityUnknown |
|---|
CVE-2018-17198CVE-2018-17198 | Exploitation statusNot confirmed | FixNo | Published05/28/2019 | SeverityUnknown |
|---|
39 Results | Page 1 of 1