Apache Roller 6.1.5 contains a critical deserialization vulnerability in its XML-RPC endpoint that allows unauthenticated remote attackers to cause deserialization of attacker-controlled data. This occurs because the endpoint accepts vendor extension types that are deserialized before authentication, even if the XML-RPC feature is disabled globally. This flaw can lead to remote code execution. Upgrading to Apache Roller 6.1.6 or later mitigates the issue by disabling these extension types and rejecting requests when XML-RPC is disabled.
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the enclosure path is relevant only when an author supplies an enclosure URL. No non-default server configuration is required, and the default empty Trackback allow-list permits all destinations. Requests can reach loopback and private-network addresses, while enclosure handling exposes response status, content type, and length. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes the outbound trackback action and stops dereferencing enclosure URLs.
Apache Roller 6.1.5 contains an XML External Entity (XXE) vulnerability that allows users with entry-editing rights to cause the server to parse attacker-controlled XML data without disabling external entity resolution. This can lead to disclosure of files readable by the Roller process. The vulnerable feature involves the Trackback response parser, which is hidden in the UI but accessible directly. Upgrading to Apache Roller 6.1.6 or later removes the vulnerable parser and mitigates the issue.
Apache Roller 6.1.5 contains a missing authorization vulnerability in its legacy XML-RPC Blogger and MetaWeblog APIs. Authenticated users can read, modify, or delete content from other weblogs because the API handlers authenticate the caller but do not verify permissions on the affected weblog or entry. This issue affects installations with the non-default global XML-RPC setting enabled. The vulnerability is fixed in Apache Roller 6.1.6 by adding explicit per-method permission checks. Users are advised to upgrade or disable the XML-RPC feature to mitigate the risk.
Apache Roller 6.1.5 contains an incorrect authorization vulnerability in its OAuth 1.0a authorization endpoint. This flaw allows an unauthenticated remote attacker who knows an outstanding request token for a configured site-wide consumer to bind that token to any user account, including administrators, by submitting an unsigned authorization request. The vulnerability arises because the endpoint derives the authorizing identity from a request-supplied value instead of the authenticated session. Only installations with an OAuth 1.0a site-wide consumer configured are affected. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by binding authorization to the logged-in session.
Apache Roller 6.1.5 contains a vulnerability that allows a weblog administrator to read sensitive files on the application classpath, including configuration files with secrets. This is possible because the Velocity template engine's include and parse directives are not confined by the sandbox that treats weblog administrators as untrusted. The issue is fixed in Apache Roller 6.1.6, which restricts includes to the active theme and removes classpath resource loading from weblog rendering.
CVE-2026-82386 is a high-severity vulnerability in Apache Roller 6.1.5 involving improper restriction of XML External Entity (XXE) references. It allows a weblog administrator to read files accessible to the Roller process and access internal network addresses by importing a crafted OPML document. This occurs because the bookmark import parser does not disable external entity resolution. No special configuration is needed to exploit this; the vulnerability is triggered via the administrator bookmark-import action. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by using a hardened parser that disables external entities and document type declarations.
Apache Roller 6.1.5 contains an authorization bypass vulnerability that allows an authenticated user with authoring rights on one weblog to access and modify resources of another weblog. This affects multi-user installations without requiring special configuration. The flaw also permits an administrator on one weblog to overwrite another weblog's Velocity template, potentially affecting content rendering. Upgrading to version 6.1.6 or later mitigates this issue by scoping resource lookups to the acting weblog.
Apache Roller 6.1.5 contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue arises because the media upload feature trusts the content type supplied during upload and serves the stored file with that type, allowing a user with media-upload rights to store active content. Media uploads are disabled by default, so only installations that enable this feature are affected. The vulnerability is fixed in Apache Roller 6.1.6, which derives the stored content type from the file content and serves non-image media as downloads.
CVE-2026-82546 is a cross-site scripting (XSS) vulnerability in Apache Roller 6.1.5. It allows an unauthenticated remote attacker to store a crafted comment-author URL via the Trackback endpoint when comments and Trackbacks are enabled on a published entry. The default settings permit the malicious URL to be approved and rendered as an active link, enabling script execution in the context of the weblog's origin. Apache Roller 6.1.6 and later remove Trackback support and suppress non-HTTP(S) comment-author links to mitigate this issue. Users unable to upgrade should disable Trackbacks and remove untrusted Trackback comments.
Apache Roller 6.1.5 contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An anonymous remote attacker can store a comment with a javascript: URI link that bypasses HTML comment formatting and executes script when clicked by a visitor. This issue affects sites with HTML enabled in comments and using the HTMLSubset comment formatter. The vulnerability is fixed in Apache Roller 6.1.6 and later by restricting restored links to http, https, and mailto URIs.
Apache Roller 6.1.5 contains a reflected cross-site scripting (XSS) vulnerability in the optional LDAP comment authenticator. This flaw allows remote attackers to inject malicious scripts via crafted request parameters that are reflected in the authenticator's HTML form without proper escaping. The vulnerability affects only sites configured to use LdapCommentAuthenticator and requires the victim to have an active session with the authenticator form loaded. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by escaping reflected values.
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
CVE-2026-92608 is a high-severity vulnerability in Apache Qpid Broker-J up to version 10.1.0. It involves improper handling of property-encoding exceptions during AMQP 1.0 to AMQP 0-10 message conversion. Authenticated message producers can exploit this flaw to disrupt message delivery to AMQP 0-10 consumers. The issue is fixed in version 10.1.1.
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
CVE-2026-97636 is an authorization bypass vulnerability in the Apache Airflow HashiCorp provider affecting multi-team deployments using the HashiCorp Vault secrets backend. A user scoped to one team can supply a specially crafted Variable key containing a path separator, causing the backend to resolve secrets belonging to other teams. Single-team deployments are not affected. The issue is fixed in version 4.8.0 and later.
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.