Org.apache.syncope:syncope-core

This hub aggregates every CVE we track for Org.apache.syncope:syncope-core, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 7 most recently published vulnerabilities affecting Org.apache.syncope:syncope-core.

• CVE-2025-65998Apache Syncope: Default AES key used for internal password encryption7.5Nov 24, 2025
• CVE-2020-1961Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expre...9.8May 4, 2020
• CVE-2020-1959A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE...9.8May 4, 2020
• CVE-2018-17186An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.7.2Nov 6, 2018
• CVE-2018-17184A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions...5.4Nov 6, 2018
• CVE-2018-1321An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Tr...7.2Mar 20, 2018
• CVE-2018-1322An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive ...4.9Mar 20, 2018