{"schema_version":1,"title":"Apache Roller vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 30 vulnerabilities in Apache Roller: 12 in the last 7 days and 30 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123374, was published on 11 November 2026. Nothing in the last four weeks, down from 18 vulnerabilities in the four before. 0 critical against 3.","url":"https://junglewise.ai/threats/technologies/roller","json_url":"https://junglewise.ai/threats/technologies/roller.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/roller","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":9,"all_time":30,"critical":3,"exploited":0,"last_7_days":12,"last_30_days":12,"last_90_days":30,"last_365_days":30},"latest":[{"cve":"CVE-2026-123374","slug":"cve-2026-123374-deserialization-of-untrusted-data-vulnerability-in-apache-roller","title":"Apache Roller XML-RPC deserialization remote code execution","severity":"info","exploited":false,"published_at":"2026-11-11T13:17:17.34+00:00","url":"https://junglewise.ai/threats/cve-2026-123374-deserialization-of-untrusted-data-vulnerability-in-apache-roller"},{"cve":"CVE-2026-122300","slug":"cve-2026-122300-missing-authorization-vulnerability-in-apache-roller-4-0-through","title":"Apache Roller missing authorization in entry editor","severity":"info","exploited":false,"published_at":"2026-11-11T13:17:17.207+00:00","url":"https://junglewise.ai/threats/cve-2026-122300-missing-authorization-vulnerability-in-apache-roller-4-0-through"},{"cve":"CVE-2026-118414","cvss":5.4,"slug":"cve-2026-118414-improper-neutralization-of-input-during-web-page-generation","title":"Apache Roller stored cross-site scripting in weblog menu","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:16.74+00:00","url":"https://junglewise.ai/threats/cve-2026-118414-improper-neutralization-of-input-during-web-page-generation"},{"cve":"CVE-2026-118413","cvss":5.4,"slug":"cve-2026-118413-improper-neutralization-of-input-during-web-page-generation","title":"Apache Roller stored cross-site scripting in blogroll import","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:16.597+00:00","url":"https://junglewise.ai/threats/cve-2026-118413-improper-neutralization-of-input-during-web-page-generation"},{"cve":"CVE-2026-118411","cvss":8.8,"slug":"cve-2026-118411-cross-site-request-forgery-csrf-in-apache-roller-5-0-1-through-6","title":"Apache Roller CSRF allowing unauthenticated administrator account creation","severity":"high","exploited":false,"published_at":"2026-11-11T13:17:16.313+00:00","url":"https://junglewise.ai/threats/cve-2026-118411-cross-site-request-forgery-csrf-in-apache-roller-5-0-1-through-6"},{"cve":"CVE-2026-118409","cvss":5.3,"slug":"cve-2026-118409-exposure-of-sensitive-information-to-an-unauthorized-actor-in","title":"Apache Roller information disclosure via search index","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:16.023+00:00","url":"https://junglewise.ai/threats/cve-2026-118409-exposure-of-sensitive-information-to-an-unauthorized-actor-in"},{"cve":"CVE-2026-118405","cvss":4.3,"slug":"cve-2026-118405-exposure-of-sensitive-information-to-an-unauthorized-actor-in","title":"Apache Roller information disclosure in user search","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:15.723+00:00","url":"https://junglewise.ai/threats/cve-2026-118405-exposure-of-sensitive-information-to-an-unauthorized-actor-in"},{"cve":"CVE-2026-111824","slug":"cve-2026-111824-improper-neutralization-of-input-during-web-page-generation","title":"Apache Roller stored cross-site scripting in custom theme media","severity":"info","exploited":false,"published_at":"2026-11-11T13:17:13.73+00:00","url":"https://junglewise.ai/threats/cve-2026-111824-improper-neutralization-of-input-during-web-page-generation"},{"cve":"CVE-2026-108338","slug":"cve-2026-108338-improper-neutralization-of-input-during-web-page-generation","title":"Apache Roller stored cross-site scripting in entry tags","severity":"info","exploited":false,"published_at":"2026-11-11T13:17:13.453+00:00","url":"https://junglewise.ai/threats/cve-2026-108338-improper-neutralization-of-input-during-web-page-generation"},{"cve":"CVE-2026-105154","cvss":6.1,"slug":"cve-2026-105154-cross-site-request-forgery-csrf-in-the-planet-feed-aggregator","title":"Apache Roller cross-site request forgery in Planet feed administration","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:13.127+00:00","url":"https://junglewise.ai/threats/cve-2026-105154-cross-site-request-forgery-csrf-in-the-planet-feed-aggregator"},{"cve":"CVE-2026-105153","cvss":7.7,"slug":"cve-2026-105153-improper-restriction-of-xml-external-entity-reference-in-apache","title":"Apache Roller XML external entity injection in AtomPub","severity":"high","exploited":false,"published_at":"2026-11-11T13:17:12.957+00:00","url":"https://junglewise.ai/threats/cve-2026-105153-improper-restriction-of-xml-external-entity-reference-in-apache"},{"cve":"CVE-2026-105152","cvss":4.3,"slug":"cve-2026-105152-exposure-of-sensitive-information-to-an-unauthorized-actor-in","title":"Apache Roller information disclosure in template wrapper","severity":"medium","exploited":false,"published_at":"2026-11-11T13:17:12.79+00:00","url":"https://junglewise.ai/threats/cve-2026-105152-exposure-of-sensitive-information-to-an-unauthorized-actor-in"},{"cve":"CVE-2026-86507","cvss":6.1,"slug":"cve-2026-86507-improper-neutralization-of-input-in-apache-roller-6-1-5-allows-an","title":"Apache Roller stored XSS in comment author URL","severity":"medium","exploited":false,"published_at":"2026-09-28T09:17:07.52+00:00","url":"https://junglewise.ai/threats/cve-2026-86507-improper-neutralization-of-input-in-apache-roller-6-1-5-allows-an"},{"cve":"CVE-2026-91206","cvss":6.1,"slug":"cve-2026-91206-improper-neutralization-of-input-during-web-page-generation-cross","title":"Apache Roller cross-site scripting in LDAP comment form","severity":"medium","exploited":false,"published_at":"2026-09-28T08:16:43.013+00:00","url":"https://junglewise.ai/threats/cve-2026-91206-improper-neutralization-of-input-during-web-page-generation-cross"},{"cve":"CVE-2026-91204","cvss":6.1,"slug":"cve-2026-91204-improper-neutralization-of-input-during-web-page-generation-cross","title":"Apache Roller cross-site scripting in HTML comments","severity":"medium","exploited":false,"published_at":"2026-09-28T08:16:42.887+00:00","url":"https://junglewise.ai/threats/cve-2026-91204-improper-neutralization-of-input-during-web-page-generation-cross"},{"cve":"CVE-2026-82546","cvss":6.1,"slug":"cve-2026-82546-improper-neutralization-of-input-during-web-page-generation-cross","title":"Apache Roller stored cross-site scripting in Trackback comments","severity":"medium","exploited":false,"published_at":"2026-09-28T08:16:42.763+00:00","url":"https://junglewise.ai/threats/cve-2026-82546-improper-neutralization-of-input-during-web-page-generation-cross"},{"cve":"CVE-2026-82387","cvss":5.4,"slug":"cve-2026-82387-improper-neutralization-of-input-during-web-page-generation-cross","title":"Apache Roller cross-site scripting in media upload","severity":"medium","exploited":false,"published_at":"2026-09-28T08:16:42.647+00:00","url":"https://junglewise.ai/threats/cve-2026-82387-improper-neutralization-of-input-during-web-page-generation-cross"},{"cve":"CVE-2026-82386","cvss":7.7,"slug":"cve-2026-82386-improper-restriction-of-xml-external-entity-reference-in-apache","title":"Apache Roller XML external entity injection in bookmark import","severity":"high","exploited":false,"published_at":"2026-09-28T08:16:42.527+00:00","url":"https://junglewise.ai/threats/cve-2026-82386-improper-restriction-of-xml-external-entity-reference-in-apache"},{"cve":"CVE-2026-82385","cvss":6.5,"slug":"cve-2026-82385-exposure-of-sensitive-information-to-an-unauthorized-actor-in","title":"Apache Roller information disclosure in Velocity templates","severity":"medium","exploited":false,"published_at":"2026-09-28T08:16:42.403+00:00","url":"https://junglewise.ai/threats/cve-2026-82385-exposure-of-sensitive-information-to-an-unauthorized-actor-in"},{"cve":"CVE-2026-82384","cvss":9.8,"slug":"cve-2026-82384-deserialization-of-untrusted-data-in-apache-roller-6-1-5-allows","title":"Apache Roller XML-RPC deserialization of untrusted data","severity":"critical","exploited":false,"published_at":"2026-09-28T08:16:42.273+00:00","url":"https://junglewise.ai/threats/cve-2026-82384-deserialization-of-untrusted-data-in-apache-roller-6-1-5-allows"},{"cve":"CVE-2026-82383","cvss":8.2,"slug":"cve-2026-82383-missing-authentication-for-critical-function-in-apache-roller-6-1","title":"Apache Roller missing authentication in setup action","severity":"high","exploited":false,"published_at":"2026-09-28T08:16:42.153+00:00","url":"https://junglewise.ai/threats/cve-2026-82383-missing-authentication-for-critical-function-in-apache-roller-6-1"},{"cve":"CVE-2026-82382","cvss":6.1,"slug":"cve-2026-82382-improper-neutralization-of-input-during-web-page-generation-cross","title":"Apache Roller cross-site scripting in frontpage theme","severity":"medium","exploited":false,"published_at":"2026-09-28T08:16:42.037+00:00","url":"https://junglewise.ai/threats/cve-2026-82382-improper-neutralization-of-input-during-web-page-generation-cross"},{"cve":"CVE-2026-82381","cvss":5.4,"slug":"cve-2026-82381-improper-neutralization-of-input-during-web-page-generation-cross","title":"Apache Roller stored cross-site scripting in authoring UI","severity":"medium","exploited":false,"published_at":"2026-09-28T08:16:41.913+00:00","url":"https://junglewise.ai/threats/cve-2026-82381-improper-neutralization-of-input-during-web-page-generation-cross"},{"cve":"CVE-2026-82380","cvss":8.1,"slug":"cve-2026-82380-cross-site-request-forgery-csrf-in-apache-roller-6-1-5-allows-a","title":"Apache Roller CSRF in state-changing actions","severity":"high","exploited":false,"published_at":"2026-09-28T08:16:41.787+00:00","url":"https://junglewise.ai/threats/cve-2026-82380-cross-site-request-forgery-csrf-in-apache-roller-6-1-5-allows-a"},{"cve":"CVE-2026-82379","cvss":7.7,"slug":"cve-2026-82379-authentication-bypass-by-capture-replay-in-apache-roller-6-1-5","title":"Apache Roller authentication bypass in AtomPub WSSE","severity":"high","exploited":false,"published_at":"2026-09-28T08:16:41.663+00:00","url":"https://junglewise.ai/threats/cve-2026-82379-authentication-bypass-by-capture-replay-in-apache-roller-6-1-5"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":3,"exploited":0,"vulnerabilities":18},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":12}],"related":[{"name":"Apache Airflow","slug":"airflow","vulnerabilities":95,"url":"https://junglewise.ai/threats/technologies/airflow"},{"name":"Apache Camel","slug":"camel","vulnerabilities":87,"url":"https://junglewise.ai/threats/technologies/camel"},{"name":"Apache Tomcat","slug":"tomcat","vulnerabilities":87,"url":"https://junglewise.ai/threats/technologies/tomcat"},{"name":"Apache Thrift","slug":"thrift","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/thrift"},{"name":"Apache Ofbiz","slug":"ofbiz","vulnerabilities":67,"url":"https://junglewise.ai/threats/technologies/ofbiz"},{"name":"Apache HTTP Server","slug":"http-server","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/http-server"},{"name":"Apache Traffic Server","slug":"traffic-server","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/traffic-server"},{"name":"Apache Brpc","slug":"brpc","vulnerabilities":36,"url":"https://junglewise.ai/threats/technologies/brpc"},{"name":"Apache CloudStack","slug":"cloudstack","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/cloudstack"},{"name":"Apache ActiveMQ","slug":"activemq","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/activemq"},{"name":"Apache Apisix","slug":"apisix","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/apisix"},{"name":"Apache Wicket","slug":"apache-wicket","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/apache-wicket"}],"technology":{"hub":true,"name":"Apache Roller","slug":"roller","vendor":{"hub":true,"name":"Apache","slug":"apache","url":"https://junglewise.ai/threats/vendors/apache"},"aliases":[],"category":"web-server","description":"Apache Roller is a blogging and content publishing application.","url":"https://junglewise.ai/threats/technologies/roller"},"most_severe":[{"cve":"CVE-2026-82377","cvss":9.9,"slug":"cve-2026-82377-missing-authorization-in-apache-roller-6-1-5-allows-an","title":"Apache Roller missing authorization in XML-RPC APIs","severity":"critical","exploited":false,"published_at":"2026-09-28T08:16:41.417+00:00","url":"https://junglewise.ai/threats/cve-2026-82377-missing-authorization-in-apache-roller-6-1-5-allows-an"},{"cve":"CVE-2026-82384","cvss":9.8,"slug":"cve-2026-82384-deserialization-of-untrusted-data-in-apache-roller-6-1-5-allows","title":"Apache Roller XML-RPC deserialization of untrusted data","severity":"critical","exploited":false,"published_at":"2026-09-28T08:16:42.273+00:00","url":"https://junglewise.ai/threats/cve-2026-82384-deserialization-of-untrusted-data-in-apache-roller-6-1-5-allows"},{"cve":"CVE-2026-82378","cvss":9,"slug":"cve-2026-82378-incorrect-authorization-in-the-oauth-1-0a-authorization-endpoint","title":"Apache Roller incorrect authorization in OAuth 1.0a endpoint","severity":"critical","exploited":false,"published_at":"2026-09-28T08:16:41.54+00:00","url":"https://junglewise.ai/threats/cve-2026-82378-incorrect-authorization-in-the-oauth-1-0a-authorization-endpoint"},{"cve":"CVE-2026-118411","cvss":8.8,"slug":"cve-2026-118411-cross-site-request-forgery-csrf-in-apache-roller-5-0-1-through-6","title":"Apache Roller CSRF allowing unauthenticated administrator account creation","severity":"high","exploited":false,"published_at":"2026-11-11T13:17:16.313+00:00","url":"https://junglewise.ai/threats/cve-2026-118411-cross-site-request-forgery-csrf-in-apache-roller-5-0-1-through-6"},{"cve":"CVE-2026-82383","cvss":8.2,"slug":"cve-2026-82383-missing-authentication-for-critical-function-in-apache-roller-6-1","title":"Apache Roller missing authentication in setup action","severity":"high","exploited":false,"published_at":"2026-09-28T08:16:42.153+00:00","url":"https://junglewise.ai/threats/cve-2026-82383-missing-authentication-for-critical-function-in-apache-roller-6-1"},{"cve":"CVE-2026-82380","cvss":8.1,"slug":"cve-2026-82380-cross-site-request-forgery-csrf-in-apache-roller-6-1-5-allows-a","title":"Apache Roller CSRF in state-changing actions","severity":"high","exploited":false,"published_at":"2026-09-28T08:16:41.787+00:00","url":"https://junglewise.ai/threats/cve-2026-82380-cross-site-request-forgery-csrf-in-apache-roller-6-1-5-allows-a"},{"cve":"CVE-2026-105153","cvss":7.7,"slug":"cve-2026-105153-improper-restriction-of-xml-external-entity-reference-in-apache","title":"Apache Roller XML external entity injection in AtomPub","severity":"high","exploited":false,"published_at":"2026-11-11T13:17:12.957+00:00","url":"https://junglewise.ai/threats/cve-2026-105153-improper-restriction-of-xml-external-entity-reference-in-apache"},{"cve":"CVE-2026-82386","cvss":7.7,"slug":"cve-2026-82386-improper-restriction-of-xml-external-entity-reference-in-apache","title":"Apache Roller XML external entity injection in bookmark import","severity":"high","exploited":false,"published_at":"2026-09-28T08:16:42.527+00:00","url":"https://junglewise.ai/threats/cve-2026-82386-improper-restriction-of-xml-external-entity-reference-in-apache"},{"cve":"CVE-2026-82379","cvss":7.7,"slug":"cve-2026-82379-authentication-bypass-by-capture-replay-in-apache-roller-6-1-5","title":"Apache Roller authentication bypass in AtomPub WSSE","severity":"high","exploited":false,"published_at":"2026-09-28T08:16:41.663+00:00","url":"https://junglewise.ai/threats/cve-2026-82379-authentication-bypass-by-capture-replay-in-apache-roller-6-1-5"},{"cve":"CVE-2026-82376","cvss":7.7,"slug":"cve-2026-82376-improper-restriction-of-xml-external-entity-reference-in-apache","title":"Apache Roller XML External Entity Injection","severity":"high","exploited":false,"published_at":"2026-09-28T08:16:41.293+00:00","url":"https://junglewise.ai/threats/cve-2026-82376-improper-restriction-of-xml-external-entity-reference-in-apache"}],"generated_at":"2026-11-12T03:07:00.164048+00:00"}