intranda vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20233
3. 202612

Newest CVEs

• CVE-2026-55486

  Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

  intranda · goobi-viewer-core

  Critical9.3
• CVE-2026-55465

  Goobi viewer: Solr injection via unvalidated region parameter in spatial search

  intranda · goobi-viewer-core

  Medium5.3
• CVE-2026-55463

  Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

  intranda · goobi-viewer-core

  Medium6.5
• CVE-2026-55459

  Goobi viewer: OpenID JWT audience not enforced by the verifier

  intranda · goobi-viewer-core

  High7.4
• CVE-2026-55457

  Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

  intranda · goobi-viewer-core

  High7.4
• CVE-2026-55444

  Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

  intranda · goobi-viewer-core

  Medium5.3
• CVE-2026-46652

  Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer

  intranda · goobi-viewer-core

  Critical9.8
• CVE-2026-46651

  Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

  intranda · goobi-viewer-core

  Critical9.8
• CVE-2026-46347

  Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

  intranda · goobi-viewer-core

  Medium6.8
• CVE-2026-46346

  Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

  intranda · goobi-viewer-core

  Medium6.5