Skip to content

Product

apache.org/cocoon vulnerabilities

4 published CVES affecting apache.org/cocoon, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
4
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest apache.org/cocoon CVEs

Newest publication first

  1. CVE-2026-108089 Apache Cocoon: Unauthenticated access to diagnostic interfaces

    Published
    HighCVSS 7.5 EPSS 0.49%

    ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and pr...

  2. CVE-2026-108088 Apache Cocoon: Cross-user cache poisoning

    Published
    HighCVSS 7.5 EPSS 0.46%

    ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all ver...

  3. CVE-2026-108087 Apache Cocoon: SQL Injection

    Published
    HighCVSS 8.8 EPSS 0.43%

    ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL proces...

  4. CVE-2026-108086 Apache Cocoon: XEE could lead to SSRF and information disclosure

    Published
    HighCVSS 7.5 EPSS 0.42%

    ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.