Known vulnerabilities in Opencast

Software: Opencast
Software CPE: cpe:2.3:a:apereo_foundation:opencast:*:*:*:*:*:*:*:*
Total vulnerabilities: 24
Public exploits: 3
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Opencast Opencast is affected by 24 known vulnerabilities: 1 critical, 4 high, 6 medium, 13 low Critical High Medium Low

Vulnerabilities (24)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138949 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
19.7, 20.2 21.07.2026 SB20260721125
#VU138943 - Session Fixation
CWE-384 High
No
No
19.7, 20.2 21.07.2026 SB20260721125
#VU127024 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2025-61788
CWE-80 Low
No
No
17.8, 18.2 23.04.2026 SB2026042394
#VU127023 - Exposure of sensitive information to an unauthorized actor
CVE-2025-61906
CWE-200 Low
No
No
17.8, 18.2 23.04.2026 SB2026042394
#VU127022 - Relative Path Traversal
CVE-2025-55202
CWE-23 Low
No
No
17.7, 18.1 23.04.2026 SB2026042393
#VU127021 - Exposure of sensitive information to an unauthorized actor
CVE-2025-54380
CWE-200 Low
No
No
17.6 23.04.2026 SB2026042392
#VU127020 - Allocation of Resources Without Limits or Throttling
CVE-2024-52797
CWE-770 Low
No
No
13.10, 14.3, 16.7 20.11.2024 SB2024112084
#VU69655 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2022-41965
CWE-601 Low
No
No
12.5 28.11.2022 SB2022112853
#VU127008 - Improper Access Control
CVE-2022-29237
CWE-284 Low
No
No
10.14, 11.7 19.05.2022 SB2022051931
#VU59086 - Files or Directories Accessible to External Parties
CVE-2021-43821
CWE-552 Medium
Available
No
10.6 22.12.2021 SB2021122209
#VU59051 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2021-45105
CWE-835 Medium
Available
No
9.12, 10.8, 11.2 18.12.2021 SB2021121802
SB2021121903
SB2021122011
and 169 more
#VU58976 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-45046
CWE-94 High
Available
Exploited
9.11, 10.7, 11.1 15.12.2021 SB2021121504
SB2021121511
SB2021121512
and 178 more
#VU127009 - Authentication Bypass by Spoofing
CVE-2021-43807
CWE-290 Low
No
No
9.10, 10.0 14.12.2021 SB2021121508
#VU127016 - Insufficiently Protected Credentials
CVE-2018-16153
CWE-522 Medium
No
No
10.6 14.12.2021 SB2021122209
#VU58816 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-44228
CWE-94 Critical
Available
Exploited
9.10, 10.6 10.12.2021 SB2021121003
SB2021121101
SB2021121201
and 338 more
#VU127012 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CVE-2021-32623
CWE-776 Low
No
No
9.6 15.06.2021 SB2021061540
#VU127010 - Improper Access Control
CVE-2021-21318
CWE-284 Low
No
No
9.2 18.02.2021 SB2021021830
#VU127011 - Improper Validation of Certificate with Host Mismatch
CVE-2020-26234
CWE-297 High
No
No
7.9, 8.9 08.12.2020 SB2020120864
#VU127018 - Use of Password Hash With Insufficient Computational Effort
CVE-2020-5229
CWE-916 Low
No
No
8.1 29.01.2020 SB2020012953
#VU127019 - Improper Access Control
CVE-2020-5228
CWE-284 Medium
No
No
7.6, 8.1 29.01.2020 SB2020012953


Showing elements 1 - 20 out of 24