71 matches found
EUVD-2026-78206
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197 Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197
Flowable flowable-engine through 8.0.0 contains an XML External Entity (XXE) injection in ProcessDiagramLayoutFactory.parseXml() , which fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations wi...
CVE-2026-91197 Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197 Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +15 more potentially affected by CVE-2026-75030 via org.apache.syncope.core.idrepo:syncope-core-idrepo-logic (>=3.0.0-m0, <=4.0.7)
org.apache.syncope.core.idrepo:syncope-core-idrepo-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.6, =3.0.0-m0, =4.0.7...
org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)
org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73668 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186777...
org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73370 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)
org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73370 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186790...
org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73370 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)
org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73370 Source advisory: MEND:CVE-2026-73370...
org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.7) +18 more potentially affected by CVE-2026-73470 via org.apache.syncope.core:syncope-core-provisioning-java (>=4.0.0-m0, <=4.0.7)
org.apache.syncope.core:syncope-core-provisioning-java MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.7 -...
org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.0.0-m0, <=4.0.7), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.0.0-m0, <=4.0.7) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.0.0-m0, <=4.0.7)
org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.7 Source cves: CVE-2026-73668 Source advisory: MEND:CVE-2026-73668...
org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)
org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73668 Source advisory: MEND:CVE-2026-73668...
PT-2026-91755
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197: Improper Restriction of XML External Entity Reference
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
Apache Syncope permission granting and access control issues
Apache Syncope is an open-source identity management and governance system that primarily provides features for user management, permission control, and role assignment. Apache Syncope has a security vulnerability that arises from the improper validation of authorization for users who register or...
org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.6), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=3.0.0-m0, <=4.0.6) potentially affected by CVE-2026-53405 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=3.0.0-m0, <=4.0.6)
org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-53405 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352472...
org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=4.1.0-m0, <=4.1.1) potentially affected by CVE-2026-53405 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=4.1.0-m0, <=4.1.1)
org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-53405 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352472...
org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.6), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=3.0.0-m0, <=4.0.6) potentially affected by CVE-2026-53421 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=3.0.0-m0, <=4.0.6)
org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-53421 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352511...
org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=4.1.0-m0, <=4.1.1) potentially affected by CVE-2026-53421 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=4.1.0-m0, <=4.1.1)
org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-53421 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352511...