intranda

Records16All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

intranda records in CISA KEV

No intranda vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Goobi Viewer Core 4 records MEDIUM

Records

16 records

TI-2026-79924 CVE-2026-46652

Path traversal in Goobi viewer lets malicious servers write files

MEDIUM 50

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00703 Published 2026-10-23 Fixed in 26.05 CWE-22

TI-2026-79923 CVE-2026-46651

Unauthenticated SSRF and local file inclusion in Goobi viewer

MEDIUM 49

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00378 Published 2026-10-23 Fixed in 26.05 CWE-306

TI-2026-32930 CVE-2026-45083 · GHSA-2rgp-f66f-4499

Goobi viewer: Unauthenticated Solr Streaming Expression Proxy

MEDIUM 49

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0041 Published 2026-05-27 Fixed in 26.04.1 CWE-306

TI-2020-11897 CVE-2020-15124

Path traversal in Goobi viewer Core

MEDIUM 44

In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01538 Published 2020-07-22 Fixed in 4.8.3 CWE-22

TI-2026-79937 CVE-2026-55486

Reflected XSS in Goobi viewer IIIF Auth authorization endpoints

MEDIUM 42

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00257 Published 2026-10-23 Fixed in 26.05 CWE-113

TI-2026-79920 CVE-2026-46346

Predictable password reset token in Goobi viewer

LOW 35

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00334 Published 2026-10-23 Fixed in 26.05 CWE-330

TI-2026-79935 CVE-2026-55463

Goobi viewer WebSocket endpoints lack authentication checks

LOW 34

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00136 Published 2026-10-23 Fixed in 26.05 CWE-1385

TI-2026-79934 CVE-2026-55459

Goobi viewer accepts OpenID tokens issued for other relying parties

LOW 34

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00205 Published 2026-10-23 Fixed in 26.05 CWE-287

TI-2026-79933 CVE-2026-55457

Authorization bypass in Goobi viewer via empty default API token

LOW 34

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00274 Published 2026-10-23 Fixed in 26.05 CWE-1392

TI-2026-79921 CVE-2026-46347

Goobi viewer generates predictable replacement passwords after reset

LOW 32

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00253 Published 2026-10-23 Fixed in 26.05 CWE-330

TI-2026-79936 CVE-2026-55465

Solr injection in Goobi viewer exposes access-restricted records

LOW 30

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00262 Published 2026-10-23 Fixed in 26.05 CWE-89

TI-2026-79932 CVE-2026-55444

Solr injection in Goobi viewer RSS feed exposes restricted records

LOW 30

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00253 Published 2026-10-23 Fixed in 26.05 CWE-20

TI-2023-13477 CVE-2023-29016 · GHSA-2r9r-8fcg-m38g

Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames

LOW 28

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2023-04-06 Fixed in 23.03 CWE-79

TI-2023-13476 CVE-2023-29015 · GHSA-622w-995c-3c3h

Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments

LOW 28

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2023-04-06 Fixed in 23.03 CWE-79

TI-2023-13475 CVE-2023-29014 · GHSA-7v7g-9vx6-vcg2

Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter

LOW 28

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2023-04-06 Fixed in 23.03 CWE-79

TI-2026-79931 CVE-2026-55442

Goobi viewer sanitizer bypass allows Solr local-parameter injection

LOW 24

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00262 Published 2026-10-23 Fixed in 26.05 CWE-116

Open these records in search →

Critical	5
High	2
Medium	9
Low	0
No CVSS	0