Oracle Opengrok vulnerabilities

3 CVEs affecting Oracle Opengrok, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-30755, published 2025-09-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-2322, published 2021-06-23. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to…
CVE-2025-21572, published 2025-05-02. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. OpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page. This happens through improper handling of path segments. The application reflects unsanitized…
CVE-2025-30755, published 2025-09-19. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens through improper handling of the revision parameter. The application reflects…