CVE-2026-56094

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor ca...

CVE-2026-56094 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor ca...

CVE-2026-56094

TYPO3 extension "Apache Solr for TYPO3 - Enterprise Search" (solr) is affected by an information disclosure vulnerability. The extension's additionalFilters request parameter allows an attacker to register a named siteHash filter before the system's own filter is applied; because the query builde...

CVE-2026-56094 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor ca...

CVE-2026-56094 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor ca...

CVE-2026-56094: Improper Neutralization of Special Elements in Data Query Logic

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor ca...

gov.nasa.pds:registry-mgr-legacy (>=2.3.9, <=2.4.0), io.github.pl-buiquang:spark-solr (4.1.0) +25 more potentially affected by CVE-2026-44825 via org.apache.solr:solr-core (>=9.4.0, <=10.0.0)

org.apache.solr:solr-core MAVEN version =9.4.0, =2.3.9, =0.1.0, =3.0.0, =2.0.0-m1, =2.0.0-m1, =9.4.0, =9.4.0, =9.4.0, =9.8.0, =9.8.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.11.0 and more Source cves: CVE-2026-44825 Source advisory: SNYK:JAVA-ORGAPACHESOLR-17139337...

gov.nasa.pds:registry-mgr-legacy (>=2.3.9, <=2.4.0), io.github.pl-buiquang:spark-solr (4.1.0) +24 more potentially affected by CVE-2026-44825 via org.apache.solr:solr-core (>=9.4.0, <=9.10.1)

org.apache.solr:solr-core MAVEN version =9.4.0, =2.3.9, =3.0.0, =2.0.0-m1, =2.0.0-m1, =9.4.0, =9.4.0, =9.4.0, =9.8.0, =9.8.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.10.1 and more Source cves: CVE-2026-44825 Source advisory: OSV:GHSA-QHR7-H655-PW6R...

gov.nasa.pds:registry-mgr-legacy (>=2.3.9, <=2.4.0), io.github.pl-buiquang:spark-solr (4.1.0) +24 more potentially affected by CVE-2026-44825 via org.apache.solr:solr-core (>=9.4.0, <=9.10.1)

org.apache.solr:solr-core MAVEN version =9.4.0, =2.3.9, =3.0.0, =2.0.0-m1, =2.0.0-m1, =9.4.0, =9.4.0, =9.4.0, =9.8.0, =9.8.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.10.1 and more Source cves: CVE-2026-44825 Source advisory: GHSA-QHR7-H655-PW6R...

org.apache.solr:solr-jwt-auth (10.0.0) potentially affected by CVE-2026-44825 via org.apache.solr:solr-core (10.0.0)

org.apache.solr:solr-core MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - org.apache.solr:solr-jwt-auth 10.0.0 Source cves: CVE-2026-44825 Source advisory: OSV:GHSA-QHR7-H655-PW6R...

org.apache.solr:solr-jwt-auth (10.0.0) potentially affected by CVE-2026-44825 via org.apache.solr:solr-core (10.0.0)

org.apache.solr:solr-core MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - org.apache.solr:solr-jwt-auth 10.0.0 Source cves: CVE-2026-44825 Source advisory: GHSA-QHR7-H655-PW6R...

Security Bulletin: IBM Operational Decision Manager - Multiple CVEs addressed related to Solr Core

Summary IBM Operational Decision Manager is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed Vulnerability Details CVEID:CVE-2024-45217...

com.indoqa.solr:spatial-corridor (8.11.2.0), com.lucidworks.spark:spark-solr (>=3.9.0, <=4.0.4) +76 more potentially affected by CVE-2026-22022 via org.apache.solr:solr-core (>=6.3.0, <=9.10.0)

org.apache.solr:solr-core MAVEN version =6.3.0, =3.9.0, =1.2.0, =0.1.1, =1.2.1, =1.6.0, =2.3.0, =2.3.19.release, =2.0.0, =3.0.1 - nl.inl.blacklab:blacklab 3.0.0 - nl.inl.blacklab:blacklab-convert-and-tag-indexer 3.0.0 and more Source cves: CVE-2026-22022 Source advisory:...

com.indoqa.solr:spatial-corridor (8.11.2.0), com.lucidworks.spark:spark-solr (>=3.9.0, <=4.0.4) +63 more potentially affected by CVE-2026-22444 via org.apache.solr:solr-core (>=8.6.3, <=9.10.0)

org.apache.solr:solr-core MAVEN version =8.6.3, =3.9.0, =1.2.0, =0.1.1, =1.2.1, =1.6.0, =2.3.0, =2.0.0, =3.0.1 - nl.inl.blacklab:blacklab 3.0.0 - nl.inl.blacklab:blacklab-convert-and-tag-indexer 3.0.0 - nl.inl.blacklab:blacklab-engine 3.0.0 and more Source cves: CVE-2026-22444 Source advisory:...

Missing Authorization

Overview org.apache.solr:solr-core is an open source enterprise search platform built on Apache Lucene Affected versions of this package are vulnerable to Missing Authorization in the Rule Based Authorization Plugin, by which the getPermissionName function can be forced to return null. An attacke...

Files or Directories Accessible to External Parties

Overview org.apache.solr:solr-core is an open source enterprise search platform built on Apache Lucene Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties in the AllowPathBuilder behavior accessible via the create core API. An attacker can read...

com.indoqa.solr:spatial-corridor (8.11.2.0), com.lucidworks.spark:spark-solr (>=3.9.0, <=4.0.4) +63 more potentially affected by CVE-2026-22444 via org.apache.solr:solr-core (>=8.6.3, <=9.10.0)

org.apache.solr:solr-core MAVEN version =8.6.3, =3.9.0, =1.2.0, =0.1.1, =1.2.1, =1.6.0, =2.3.0, =2.0.0, =3.0.1 - nl.inl.blacklab:blacklab 3.0.0 - nl.inl.blacklab:blacklab-convert-and-tag-indexer 3.0.0 - nl.inl.blacklab:blacklab-engine 3.0.0 and more Source cves: CVE-2026-22444 Source advisory:...

EUVD-2026-3665

The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting...

XML Entity Expansion (XEE)

org.apache.solr, solr-core is vulnerable to an XML Entity Expansion XEE. The vulnerability is due to XML resource consumption caused by the use of XML DOCTYPE and ENTITY declarations, which allows an attacker to trigger excessive memory usage during XML parsing, leading to out-of-memory errors...

cool.solr:solr-analyzers (1.2.1), cool.solr:solr-forward-authentication-plugin (>=1.0.0, <=1.0.1) +27 more potentially affected by CVE-2025-24814 via org.apache.solr:solr-core (8.11.1)

org.apache.solr:solr-core MAVEN version 8.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - cool.solr:solr-analyzers 1.2.1 - cool.solr:solr-forward-authentication-plugin =1.0.0, =1.4.1, =1.7.1, =4.0.0...