Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.8 - Apache Syncope 4.1.0-M0 through 4.1.3 Description: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via...
CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/474
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Fireperf: Open-source network testing tool for firewalls and routers
The IPFire project has released fireperf, an open-source measurement tool that opens connections at a fixed rate and reports what the device in the middle did with each…
Re: CVE-2026-98432: init_on_free=1 as an additional interim mitigation
Posted by Sultan Alsawaf on Nov 02 Hi Rui, I'm a member of the kernel team at CIQ. I looked into your init_on_free=1 suggestion, and unfortunately it doesn't do anything…
Re: OATH Toolkit PSKC Signature Verification bypass in libpskc (CVE-2026-109117)
Posted by Simon Josefsson on Nov 02 FYI - also via https://oath-toolkit.codeberg.page/CVE-2026-109117.html /Simon Simon Josefsson via OATH Toolkit general discussions…
Chinese hackers use ARTEX AI in automated attacks against 200 orgs
Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries.
CVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.8 -…
CVE-2026-113511: Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.8 -…