{"schema_version":1,"title":"openEQUELLA vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 8 vulnerabilities in openEQUELLA: 0 in the last 7 days and 8 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-66092, was published on 29 October 2026. 6 vulnerabilities in the last four weeks, up 200% on the four before (2).","url":"https://junglewise.ai/threats/technologies/openequella","json_url":"https://junglewise.ai/threats/technologies/openequella.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/openequella","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":2,"all_time":8,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":6,"last_90_days":8,"last_365_days":8},"latest":[{"cve":"CVE-2026-66092","slug":"cve-2026-66092-in-openequella-before-2026-2-the-pre-login-notice-is-stored-as","title":"openEQUELLA stored cross-site scripting in login notice","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:53.057+00:00","url":"https://junglewise.ai/threats/cve-2026-66092-in-openequella-before-2026-2-the-pre-login-notice-is-stored-as"},{"cve":"CVE-2026-66091","slug":"cve-2026-66091-in-openequella-before-2026-1-the-get-api-userquery-userinfobackup","title":"openEQUELLA authentication bypass in user info endpoint","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:52.933+00:00","url":"https://junglewise.ai/threats/cve-2026-66091-in-openequella-before-2026-1-the-get-api-userquery-userinfobackup"},{"cve":"CVE-2026-66090","slug":"cve-2026-66090-in-openequella-before-2026-1-the-xml-parser-used-for-item","title":"openEQUELLA XXE in item metadata XML parser","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:52.803+00:00","url":"https://junglewise.ai/threats/cve-2026-66090-in-openequella-before-2026-1-the-xml-parser-used-for-item"},{"cve":"CVE-2026-66089","slug":"cve-2026-66089-in-openequella-before-2026-1-the-soap-api-parses-xml-supplied-in","title":"openEQUELLA XML external entity injection in SOAP API","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:52.663+00:00","url":"https://junglewise.ai/threats/cve-2026-66089-in-openequella-before-2026-1-the-soap-api-parses-xml-supplied-in"},{"cve":"CVE-2026-66088","slug":"cve-2026-66088-in-openequella-before-2026-1-the-system-execute-function","title":"openEQUELLA OS command injection in scripting engine","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:52.523+00:00","url":"https://junglewise.ai/threats/cve-2026-66088-in-openequella-before-2026-1-the-system-execute-function"},{"cve":"CVE-2026-16889","slug":"cve-2026-16889-in-openequella-before-2026-1-the-pre-login-notice-image-upload","title":"openEQUELLA stored XSS in pre-login notice image upload","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:51.803+00:00","url":"https://junglewise.ai/threats/cve-2026-16889-in-openequella-before-2026-1-the-pre-login-notice-image-upload"},{"cve":"CVE-2026-67615","cvss":8.8,"epss":0.01,"slug":"cve-2026-67615-openequella-before-2026-1-0-contains-an-authenticated-remote-code","title":"openEQUELLA remote code execution via Java deserialization","severity":"high","exploited":false,"published_at":"2026-09-22T21:17:31.1+00:00","url":"https://junglewise.ai/threats/cve-2026-67615-openequella-before-2026-1-0-contains-an-authenticated-remote-code"},{"cve":"CVE-2026-94109","cvss":8,"epss":0.0078,"slug":"cve-2026-94109-openequella-before-2026-1-0-contains-an-authenticated-stored","title":"openEQUELLA stored server-side template injection in FreeMarker","severity":"high","exploited":false,"published_at":"2026-09-20T12:17:06.62+00:00","url":"https://junglewise.ai/threats/cve-2026-94109-openequella-before-2026-1-0-contains-an-authenticated-stored"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"openEQUELLA","slug":"openequella","vendor":{"hub":true,"name":"openEQUELLA","slug":"openequella","url":"https://junglewise.ai/threats/vendors/openequella"},"aliases":[],"category":"digital-repository","description":"Open-source digital repository system for managing institutional content.","url":"https://junglewise.ai/threats/technologies/openequella"},"most_severe":[{"cve":"CVE-2026-67615","cvss":8.8,"epss":0.01,"slug":"cve-2026-67615-openequella-before-2026-1-0-contains-an-authenticated-remote-code","title":"openEQUELLA remote code execution via Java deserialization","severity":"high","exploited":false,"published_at":"2026-09-22T21:17:31.1+00:00","url":"https://junglewise.ai/threats/cve-2026-67615-openequella-before-2026-1-0-contains-an-authenticated-remote-code"},{"cve":"CVE-2026-94109","cvss":8,"epss":0.0078,"slug":"cve-2026-94109-openequella-before-2026-1-0-contains-an-authenticated-stored","title":"openEQUELLA stored server-side template injection in FreeMarker","severity":"high","exploited":false,"published_at":"2026-09-20T12:17:06.62+00:00","url":"https://junglewise.ai/threats/cve-2026-94109-openequella-before-2026-1-0-contains-an-authenticated-stored"},{"cve":"CVE-2026-66092","slug":"cve-2026-66092-in-openequella-before-2026-2-the-pre-login-notice-is-stored-as","title":"openEQUELLA stored cross-site scripting in login notice","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:53.057+00:00","url":"https://junglewise.ai/threats/cve-2026-66092-in-openequella-before-2026-2-the-pre-login-notice-is-stored-as"},{"cve":"CVE-2026-66091","slug":"cve-2026-66091-in-openequella-before-2026-1-the-get-api-userquery-userinfobackup","title":"openEQUELLA authentication bypass in user info endpoint","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:52.933+00:00","url":"https://junglewise.ai/threats/cve-2026-66091-in-openequella-before-2026-1-the-get-api-userquery-userinfobackup"},{"cve":"CVE-2026-66090","slug":"cve-2026-66090-in-openequella-before-2026-1-the-xml-parser-used-for-item","title":"openEQUELLA XXE in item metadata XML parser","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:52.803+00:00","url":"https://junglewise.ai/threats/cve-2026-66090-in-openequella-before-2026-1-the-xml-parser-used-for-item"},{"cve":"CVE-2026-66089","slug":"cve-2026-66089-in-openequella-before-2026-1-the-soap-api-parses-xml-supplied-in","title":"openEQUELLA XML external entity injection in SOAP API","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:52.663+00:00","url":"https://junglewise.ai/threats/cve-2026-66089-in-openequella-before-2026-1-the-soap-api-parses-xml-supplied-in"},{"cve":"CVE-2026-66088","slug":"cve-2026-66088-in-openequella-before-2026-1-the-system-execute-function","title":"openEQUELLA OS command injection in scripting engine","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:52.523+00:00","url":"https://junglewise.ai/threats/cve-2026-66088-in-openequella-before-2026-1-the-system-execute-function"},{"cve":"CVE-2026-16889","slug":"cve-2026-16889-in-openequella-before-2026-1-the-pre-login-notice-image-upload","title":"openEQUELLA stored XSS in pre-login notice image upload","severity":"info","exploited":false,"published_at":"2026-10-29T02:16:51.803+00:00","url":"https://junglewise.ai/threats/cve-2026-16889-in-openequella-before-2026-1-the-pre-login-notice-image-upload"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}