org.apache.camel.maven:camel-servicenow-maven-plugin (>=2.23.4, <=2.24.2), org.apache.camel:camel-linkedin (>=2.23.4, <=2.24.2) +11 more potentially affected by CVE-2026-50628 via org.apache.cxf:cxf-rt-rs-security-oauth2 (3.2.10)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 3.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.camel.maven:camel-servicenow-maven-plugin =2.23.4, =2.23.4, =2.23.4...

com.liferay:org.apache.cxf.rt.rs.security.oauth2 (3.2.14.liferay-patched-1), org.apache.cxf.systests:cxf-systests-rs-security (3.2.14) +6 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (3.2.14)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 3.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - com.liferay:org.apache.cxf.rt.rs.security.oauth2 3.2.14.liferay-patched-1 -...

org.apache.camel.maven:camel-servicenow-maven-plugin (>=2.21.2, <=2.22.5), org.apache.camel:camel-linkedin (>=2.21.2, <=2.22.5) +12 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (3.2.5)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 3.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.camel.maven:camel-servicenow-maven-plugin =2.21.2, =2.21.2, =2.21.2,...

org.apache.camel.maven:camel-servicenow-maven-plugin (>=2.21.2, <=2.22.5), org.apache.camel:camel-linkedin (>=2.21.2, <=2.22.5) +12 more potentially affected by CVE-2026-50623 via org.apache.cxf:cxf-rt-rs-security-oauth2 (3.2.5)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 3.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.camel.maven:camel-servicenow-maven-plugin =2.21.2, =2.21.2, =2.21.2,...

org.apache.camel.maven:camel-servicenow-maven-plugin (>=2.23.0, <=2.24.1), org.apache.camel:camel-linkedin (>=2.23.0, <=2.24.1) +30 more potentially affected by CVE-2026-50628 via org.apache.cxf:cxf-rt-rs-security-oauth2 (3.2.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.camel.maven:camel-servicenow-maven-plugin =2.23.0, =2.23.0, =2.23.0,...

org.apache.cxf.fediz.systests.federation:fediz-systests-federation-oidcidpwebapp (1.4.4), org.apache.cxf.fediz:fediz-idp (1.4.4) +9 more potentially affected by CVE-2026-50627 via org.apache.cxf:cxf-rt-rs-security-oauth2 (3.1.16)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 3.1.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.cxf.fediz.systests.federation:fediz-systests-federation-oidcidpweba...

org.apache.syncope:syncope-core (>=1.0.9, <=1.1.8), org.springframework.security:spring-security-cas (3.1.6.release) +5 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.1.6.release)

org.springframework.security:spring-security-web MAVEN version 3.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.apache.syncope:syncope-core =1.0.9, =1.4.9, =1.4.9,...

CVE-2026-42782

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This issue affects...

CVE-2026-42797

Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.0), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.0) +33 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.0)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0 and more Source cves: CVE-2026-42782https://vu...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.0), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.0) +36 more potentially affected by CVE-2026-42797 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.1.0-m0, <=4.1.0)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.0), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.0) +36 more potentially affected by CVE-2026-42797 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.1.0-m0, <=4.1.0)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.5), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.5) +36 more potentially affected by CVE-2026-42797 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.0.0-m0, <=4.0.5)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.5 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.5), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.5) +36 more potentially affected by CVE-2026-42797 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.0.0-m0, <=4.0.5)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.5 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=3.0.16), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=3.0.16) +34 more potentially affected by CVE-2026-42797 via org.apache.syncope.core:syncope-core-provisioning-api (>=3.0.0-m0, <=3.0.16)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.16 -...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=3.0.16), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=3.0.16) +34 more potentially affected by CVE-2026-42797 via org.apache.syncope.core:syncope-core-provisioning-api (>=3.0.0-m0, <=3.0.16)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.16 -...

GHSA-VR35-JM2F-8WG2 Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries

Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related...

Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries

Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=3.0.16), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=3.0.16) +30 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=3.0.16)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.16 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=3.0.16), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=3.0.16) +30 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=3.0.16)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.16 and more Source cves:...