Apache Roller

Search everything

Mentions · 7d1
Mentions · 30d1
All mentions19
First seenSep 25, 2026
Last mentioned4h ago

Timeline

19 articles · newest first

Apache Roller 6.1.7 fixes 15 security issues, including XXE

The Apache Roller PMC published 15 advisories on November 11, 2026, with fixes in release 6.1.7.

oss-security16:12 UTC · 4h agoVulnerability

CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator

Apache Roller 6.1.5 has a moderate reflected XSS in its optional LDAP comment authenticator.

oss-securitySep 25, 21:48 UTC · Sep 25, 2026Vulnerability 6 sourcesCVE-2026-912062

CVE-2026-91204: Apache Roller: Stored javascript: URI in HTML comments

Apache Roller 6.1.5 lets anonymous users store a javascript: URI that executes for comment visitors.

oss-securitySep 25, 21:46 UTC · Sep 25, 2026Vulnerability 6 sourcesCVE-2026-912041 · 1 read

CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL

Apache Roller 6.1.5 stored XSS can run in moderator or administrator sessions via comment-author URLs.

oss-securitySep 25, 21:45 UTC · Sep 25, 2026Vulnerability 6 sourcesCVE-2026-865073 · 1 read

CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links

Apache Roller 6.1.5 has stored XSS via crafted Trackback author URLs, CVE-2026-82546.

oss-securitySep 25, 21:43 UTC · Sep 25, 2026Vulnerability 6 sourcesCVE-2026-825461 · 1 read

CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type

Apache Roller 6.1.5 allows media uploaders to store XSS by spoofing content type, CVE-2026-82387.

oss-securitySep 25, 21:41 UTC · Sep 25, 2026Vulnerability 6 sourcesCVE-2026-823871

CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import

Apache Roller 6.1.5 lets weblog admins read local files via XXE in OPML imports.

oss-securitySep 25, 21:39 UTC · Sep 25, 2026Vulnerability 6 sourcesCVE-2026-823861 · 1 read

CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Apache Roller 6.1.5 lets admins escape the Velocity sandbox and read classpath secrets.

oss-securitySep 25, 21:37 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823851

CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Apache Roller 6.1.5 has unauthenticated XML-RPC deserialization rated CVSS 9.8.

oss-securitySep 25, 21:35 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823841 · 1 read

CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering

Apache Roller 6.1.5 lets unauthenticated attackers persistently change the site frontpage weblog selection.

oss-securitySep 25, 21:33 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823832 · 1 read

CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter

Apache Roller 6.1.5 reflected XSS targets frontpage-theme visitors through a crafted directory parameter.

oss-securitySep 25, 21:31 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823821

CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI

Apache Roller 6.1.5 stored XSS lets authors inject content that runs in the authoring UI.

oss-securitySep 25, 21:30 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823811

CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation

Apache Roller 6.1.5 CSRF filters accept requests without the salt token, enabling forged state-changing actions.

oss-securitySep 25, 21:28 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823801

CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed

Apache Roller 6.1.5 lets attackers replay captured WSSE digest headers to bypass AtomPub authentication.

oss-securitySep 25, 21:26 UTC · Sep 25, 2026VulnerabilityCVE-2026-823791 · 1 read

CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity

Apache Roller 6.1.5 OAuth lets attackers bind a known request token to any account, including an administrator.

oss-securityupdated Sep 25, 21:37 UTC · Sep 25, 2026first Sep 25, 21:24 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823783

CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Apache Roller 6.1.5 lets authenticated users read, modify, or delete other weblogs via XML-RPC.

oss-securityupdated Sep 25, 21:37 UTC · Sep 25, 2026first Sep 25, 21:22 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823771

CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser

Apache Roller 6.1.5 parses trackback responses with XXE enabled, exposing server files.

oss-securityupdated Sep 25, 21:37 UTC · Sep 25, 2026first Sep 25, 21:21 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823761 · 1 read

CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs

Apache Roller 6.1.5 lets weblog editors trigger SSRF through trackback and enclosure URLs.

oss-securityupdated Sep 25, 21:37 UTC · Sep 25, 2026first Sep 25, 21:19 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823751 · 1 read

CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

Apache Roller 6.1.5 lets one weblog's authors tamper with another weblog's resources.

oss-securityupdated Sep 25, 21:37 UTC · Sep 25, 2026first Sep 25, 21:17 UTC · Sep 25, 2026Vulnerability 11 sourcesCVE-2026-823481

Related CVEs

by mentions

CVE-2026-823779.9
Missing authorization in Apache Roller XML-RPC APIs
published Sep 28, 2026Apache Roller
CVE-2026-823849.8
Unauthenticated deserialization RCE in Apache Roller 6.1.5
published Sep 28, 2026Apache Software Foundation Apache Roller
CVE-2026-823838.2
Missing authentication lets attackers change Apache Roller frontpage
published Sep 28, 2026Apache Software Foundation Apache Roller
CVE-2026-823808.1
CSRF protection bypass in Apache Roller 6.1.5
published Sep 28, 2026Apache Software Foundation Apache Roller
CVE-2026-823797.7
WSSE capture-replay auth bypass in Apache Roller 6.1.5
published Sep 28, 2026Apache Software Foundation Apache Roller
CVE-2026-823757.4
Authenticated SSRF in Apache Roller 6.1.5
published Sep 28, 2026Apache Software Foundation Apache Roller
CVE-2026-823856.5
Classpath secret disclosure via templates in Apache Roller
published Sep 28, 2026Apache Software Foundation Apache Roller
CVE-2026-823826.1
Reflected XSS in Apache Roller frontpage theme
published Sep 28, 2026Apache Software Foundation Apache Roller
CVE-2026-865076.1
Stored XSS in Apache Roller comment moderation
published Sep 28, 2026Apache Software Foundation Apache Roller
CVE-2026-823875.4
Stored XSS in Apache Roller via media upload type
published Sep 28, 2026Apache Software Foundation Apache Roller

Appears with

Apache Software Foundationorganization · 18
Apache Software Foundationvendor · 10
Apachevendor · 9

Entities are extracted by the model from each article. First seen Sep 25, 2026, last mentioned 4h ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.