CVE-2026-23795Apache Syncope: Console XXE on Keymaster parametersCVSSUnrated–Not in KEV1.9%EPSS1article
CVE-2026-57308Apache Syncope: SQL injection vulnerability in Audit Events searchCVSS9.8Critical–Not in KEV0.8%EPSS1article
CVE-2026-62183Apache Syncope: User self-service privilege escalationCVSS9.8Critical–Not in KEV0.7%EPSS1article
CVE-2026-82232Apache Syncope: SQL injection via sort parameter in Task searchCVSS9.8Critical–Not in KEV0.6%EPSS1article
CVE-2026-23794Apache Syncope: Reflected XSS on Enduser LoginCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-73470Apache Syncope: Delegating users can grant unowned RolesCVSS9.8Critical–Not in KEV0.5%EPSS1article
CVE-2026-77147Apache Syncope: Groovy Sandbox escape for empty CommandArgsCVSS6.5Medium–Not in KEV0.5%EPSS1article
CVE-2026-73178Apache Syncope: JWT Access Token takeoverCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-87779Apache Syncope: AES Secret Key disclosure via log outputCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-73236Apache Syncope: Cross-Realm authorization bypass in delegated administrationCVSS7.5High–Not in KEV0.4%EPSS1article
How these numbers are made
CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.