Improper Control Of Generation Of Code

org.apache.syncope.core, syncope-core-spring is vulnerable to Improper Control of Generation of Code. The vulnerability is due to insufficient validation of administrator-provided Groovy Command classes in the CommandArgs static implementation, which allows an attacker with sufficient...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-78330 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-78330https://vu...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the JWT authentication process when the JWKS settings, including protocol and key, are disclosed. An attacker can gain administrative privileges by authenticating with a valid low-privilege JWT and...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +39 more potentially affected by CVE-2026-78330 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 and more Source cves: CVE-2026-78330https://vulners.com/cve...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-77147 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-77147https://vu...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the CommandArgs static implementation. An attacker can execute arbitrary code by crafting a malicious Groovy Command class that bypasses the Groovy security sandbox. Remediation Upgrade...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +39 more potentially affected by CVE-2026-77147 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 and more Source cves: CVE-2026-77147https://vulners.com/cve...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.7) +33 more potentially affected by CVE-2026-77147 via org.apache.syncope.core:syncope-core-spring (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.7 and more Source cves: CVE-2026-77147https://vulne...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-77147 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-77147https://vu...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the process of configuring an AES key of non-standard length, where the provided value is padded with random characters and the resulting key is output to log files. An attacker can...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.15, <=3.0.16), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.15, <=3.0.16) +29 more potentially affected by CVE-2026-87779 via org.apache.syncope.core:syncope-core-spring (>=3.0.15, <=3.0.16)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.16 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.3, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.3, <=4.0.7) +33 more potentially affected by CVE-2026-87779 via org.apache.syncope.core:syncope-core-spring (>=4.0.3, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.7 and more Source cves: CVE-2026-87779 Source advisory:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-87779 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-87779https://vu...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.3, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.3, <=4.0.7) +33 more potentially affected by CVE-2026-87785 via org.apache.syncope.core:syncope-core-spring (>=4.0.3, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.7 and more Source cves: CVE-2026-87785 Source advisory:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-87785 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-87785https://vu...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.15, <=3.0.16), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.15, <=3.0.16) +29 more potentially affected by CVE-2026-87785 via org.apache.syncope.core:syncope-core-spring (>=3.0.15, <=3.0.16)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.15, =3.0.16 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-78330 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-78330https://vu...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.7) +33 more potentially affected by CVE-2026-78330 via org.apache.syncope.core:syncope-core-spring (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.7 and more Source cves: CVE-2026-78330https://vulne...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.3, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.3, <=4.0.7) +33 more potentially affected by CVE-2026-87779 via org.apache.syncope.core:syncope-core-spring (>=4.0.3, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.7 and more Source cves: CVE-2026-87779 Source advisory:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-87779 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-87779https://vu...