org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +39 more potentially affected by CVE-2026-78330 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 and more Source cves: CVE-2026-78330https://vulners.com/cve...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-78330 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-78330https://vu...

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-rest-cxf (>=3.0.0-m0, <=4.0.7) potentially affected by CVE-2026-78336 via org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =4.0.7 Source cves: CVE-2026-78336 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTOIDCC4UI-20186775...

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-rest-cxf (>=4.1.0-m0, <=4.1.2) potentially affected by CVE-2026-78336 via org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-78336 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTOIDCC4UI-20186775...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +43 more potentially affected by CVE-2026-77883 via org.apache.syncope.core:syncope-core-provisioning-api (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 and more Source cves: CVE-2026-77883https://vul...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +36 more potentially affected by CVE-2026-77883 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves:...

org.apache.syncope.client.am:syncope-client-am-console (>=4.1.0-m0, <=4.1.2), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.1.0-m0, <=4.1.2) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 - org.apache.syncope.ext.s...

org.apache.syncope.client.am:syncope-client-am-console (>=4.0.4, <=4.0.7), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.0.4, <=4.0.7) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.0.4, <=4.0.7)

org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui MAVEN version =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4,...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +13 more potentially affected by CVE-2026-75030 via org.apache.syncope.core.idrepo:syncope-core-idrepo-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idrepo:syncope-core-idrepo-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 So...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +15 more potentially affected by CVE-2026-75030 via org.apache.syncope.core.idrepo:syncope-core-idrepo-logic (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core.idrepo:syncope-core-idrepo-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.6, =3.0.0-m0, =4.0.7...

Missing Authorization

Overview org.apache.syncope.core.idrepo:syncope-core-idrepo-logic is an Apache Syncope Core IdRepo Logic Affected versions of this package are vulnerable to Missing Authorization due to incomplete authorization checks in the deprovisioning process for group members. An attacker can perform...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=3.0.0-m0, <=4.0.7), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.7) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 Source cves: CVE-2026-73668 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186777...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73668 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186777...

SQL Injection

Overview org.apache.syncope.core:syncope-core-persistence-jpa is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to SQL Injection via the...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-77051 via org.apache.syncope.core:syncope-core-persistence-jpa (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-persistence-jpa MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-77051 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECORE-20186778...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the REST API. An attacker can access confidential configuration values from other realms by leveraging administrative entitlements in one realm to read connector configurations scoped to another realm...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +18 more potentially affected by CVE-2026-75015 via org.apache.syncope.core:syncope-core-provisioning-java (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-provisioning-java MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 -...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +20 more potentially affected by CVE-2026-75015 via org.apache.syncope.core:syncope-core-provisioning-java (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-provisioning-java MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 -...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core:syncope-core-persistence-jpa (>=4.1.0-m0, <=4.1.2) +13 more potentially affected by CVE-2026-73579 via org.apache.syncope.core:syncope-core-persistence-common (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-persistence-common MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0,...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the transformation of search requests into backend queries, where the Realms filter may be rendered empty for non-recursive searches. An attacker can access unauthorized data by crafting specific non-recursive...