# Omnispace Agora Project vulnerabilities Source: https://junglewise.ai/threats/technologies/agora-project Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/agora-project.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 21 vulnerabilities in Omnispace Agora Project: 0 in the last 7 days and 21 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-63171, was published on 13 October 2026. 21 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 21 - All time: 21 (1 critical, 0 exploited in the wild) ## About Omnispace Agora Project Web application for satellite mission planning and management. ## Latest Omnispace Agora Project vulnerabilities - [CVE-2026-63171: Omnispace Agora Project stored cross-site scripting in forum](https://junglewise.ai/threats/cve-2026-63171-omnispace-agora-project-before-26-10-0-contains-a-stored-cross) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-63169: Omnispace Agora Project stored cross-site scripting in messenger](https://junglewise.ai/threats/cve-2026-63169-omnispace-agora-project-before-26-10-0-contains-a-stored-cross) (medium, CVSS 6.4, published 13 Oct 2026) - [CVE-2026-63168: Omnispace Agora Project stored cross-site scripting in LDAP import](https://junglewise.ai/threats/cve-2026-63168-omnispace-agora-project-before-26-10-0-contains-a-stored-cross) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-63157: Omnispace Agora Project stored cross-site scripting in Links module](https://junglewise.ai/threats/cve-2026-63157-omnispace-agora-project-before-26-10-0-contains-a-stored-cross) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-63156: Omnispace Agora Project reflected XSS in visioUrl parameter](https://junglewise.ai/threats/cve-2026-63156-omnispace-agora-project-before-26-10-0-contains-a-reflected-cross) (medium, CVSS 6.1, published 13 Oct 2026) - [CVE-2026-63174: Omnispace Agora Project broken access control in user assignment](https://junglewise.ai/threats/cve-2026-63174-omnispace-agora-project-before-26-10-0-contains-a-broken-access) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-63172: Omnispace Agora Project broken access control in user creation](https://junglewise.ai/threats/cve-2026-63172-omnispace-agora-project-before-26-10-0-contains-a-broken-access) (high, CVSS 7.1, published 13 Oct 2026) - [CVE-2026-63165: Omnispace Agora Project SQL injection in calendar](https://junglewise.ai/threats/cve-2026-63165-omnispace-agora-project-before-26-10-0-contains-a-sql-injection) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-63163: Omnispace Agora Project broken access control in MobileFileDownload](https://junglewise.ai/threats/cve-2026-63163-omnispace-agora-project-before-26-10-0-contains-a-broken-access) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-63162: Omnispace Agora Project path traversal in file upload](https://junglewise.ai/threats/cve-2026-63162-omnispace-agora-project-before-26-10-0-contains-a-path-traversal) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-63161: Omnispace Agora Project session fixation vulnerability](https://junglewise.ai/threats/cve-2026-63161-omnispace-agora-project-before-26-10-0-contains-a-session) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-63160: Omnispace Agora Project plaintext remember-me token storage](https://junglewise.ai/threats/cve-2026-63160-omnispace-agora-project-before-26-10-0-contains-a-vulnerability) (high, CVSS 7.4, published 13 Oct 2026) - [CVE-2026-63159: Omnispace Agora Project predictable password-reset token](https://junglewise.ai/threats/cve-2026-63159-omnispace-agora-project-before-26-10-0-contains-a-predictable) (high, CVSS 7.4, published 13 Oct 2026) - [CVE-2026-63158: Omnispace Agora Project authentication bypass in cookie handler](https://junglewise.ai/threats/cve-2026-63158-omnispace-agora-project-before-26-10-0-contains-an-authentication) (high, CVSS 7.4, published 13 Oct 2026) - [CVE-2026-63154: Omnispace Agora Project SQL identifier injection in user import](https://junglewise.ai/threats/cve-2026-63154-omnispace-agora-project-before-26-10-0-contains-a-sql-identifier) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-63153: Omnispace Agora Project access control bypass in setAffectations](https://junglewise.ai/threats/cve-2026-63153-omnispace-agora-project-before-26-10-0-contains-a-broken-access) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-63152: Omnispace Agora Project SQL injection in category filter](https://junglewise.ai/threats/cve-2026-63152-omnispace-agora-project-before-26-10-0-contains-a-second-order) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-63149: Omnispace Agora Project weak password generation in account creation](https://junglewise.ai/threats/cve-2026-63149-omnispace-agora-project-before-26-10-0-contains-an-insecure) (high, CVSS 7.4, published 13 Oct 2026) - [CVE-2026-63148: Omnispace Agora Project stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2026-63148-omnispace-agora-project-before-26-10-0-contains-a-stored-cross) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-63147: Omnispace Agora Project stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2026-63147-omnispace-agora-project-before-26-10-0-contains-a-stored-cross) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-63146: Omnispace Agora Project code injection in config file](https://junglewise.ai/threats/cve-2026-63146-omnispace-agora-project-before-26-10-0-contains-a-code-injection) (critical, CVSS 9.8, published 13 Oct 2026) ## Most severe Omnispace Agora Project vulnerabilities - [CVE-2026-63146: Omnispace Agora Project code injection in config file](https://junglewise.ai/threats/cve-2026-63146-omnispace-agora-project-before-26-10-0-contains-a-code-injection) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-63162: Omnispace Agora Project path traversal in file upload](https://junglewise.ai/threats/cve-2026-63162-omnispace-agora-project-before-26-10-0-contains-a-path-traversal) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-63154: Omnispace Agora Project SQL identifier injection in user import](https://junglewise.ai/threats/cve-2026-63154-omnispace-agora-project-before-26-10-0-contains-a-sql-identifier) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-63161: Omnispace Agora Project session fixation vulnerability](https://junglewise.ai/threats/cve-2026-63161-omnispace-agora-project-before-26-10-0-contains-a-session) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-63165: Omnispace Agora Project SQL injection in calendar](https://junglewise.ai/threats/cve-2026-63165-omnispace-agora-project-before-26-10-0-contains-a-sql-injection) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-63152: Omnispace Agora Project SQL injection in category filter](https://junglewise.ai/threats/cve-2026-63152-omnispace-agora-project-before-26-10-0-contains-a-second-order) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-63153: Omnispace Agora Project access control bypass in setAffectations](https://junglewise.ai/threats/cve-2026-63153-omnispace-agora-project-before-26-10-0-contains-a-broken-access) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-63174: Omnispace Agora Project broken access control in user assignment](https://junglewise.ai/threats/cve-2026-63174-omnispace-agora-project-before-26-10-0-contains-a-broken-access) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-63163: Omnispace Agora Project broken access control in MobileFileDownload](https://junglewise.ai/threats/cve-2026-63163-omnispace-agora-project-before-26-10-0-contains-a-broken-access) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-63158: Omnispace Agora Project authentication bypass in cookie handler](https://junglewise.ai/threats/cve-2026-63158-omnispace-agora-project-before-26-10-0-contains-an-authentication) (high, CVSS 7.4, published 13 Oct 2026) ## Vulnerabilities per week 21 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 21 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Omnispace Agora Project vulnerabilities", https://junglewise.ai/threats/technologies/agora-project, 13 November 2026.