CVE Tools
Track your stack

Apache Syncope

45 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Apache Syncope, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Apache Syncope CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Apache Syncope CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-101
2025-111
2025-120
2026-010
2026-022
2026-030
2026-040
2026-052
2026-060
2026-076
2026-080
2026-0922
2026-100
2026-115

Severity

How the 45 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1743%
  • High1128%
  • Medium1230%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache Syncope.

  1. CVE-2026-114364Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search—
  2. CVE-2026-113687Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass—
  3. CVE-2026-113511Apache Syncope: Delegated administration boundaries can be bypassed for Realm update—
  4. CVE-2026-110535Apache Syncope: AuthProfile value escalation via self-service update—
  5. CVE-2026-109083Apache Syncope: Remote Code Execution via Flowable JUEL expression—
  6. CVE-2026-73191Apache Syncope: CAS service URL injection via Forwarded HTTP headers6.1
  7. CVE-2026-73195Apache Syncope: CSV export spreadsheet formula injection7.3
  8. CVE-2026-73236Apache Syncope: Cross-Realm authorization bypass in delegated administration7.5
  9. CVE-2026-73370Apache Syncope: Cross-Realm boundaries reconciliation bypass9.8
  10. CVE-2026-73178Apache Syncope: JWT Access Token takeover7.5
  11. CVE-2026-73470Apache Syncope: Delegating users can grant unowned Roles9.8
  12. CVE-2026-73579Apache Syncope: Non-recursive Any search could skip Realms restrictions9.8
  13. CVE-2026-75015Apache Syncope: Nested secrets leak cleartext into audit records readable4.9
  14. CVE-2026-75030Apache Syncope: Incomplete authorization checks for Group members deprovisioning9.8
  15. CVE-2026-77051Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search9.8

Product grouping is registry-driven, with AI assist and human review. How it works