Apache Openmeetings vulnerabilities

29 CVEs affecting Apache Openmeetings, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-49488, published 2026-07-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-54676, published 2025-01-08. Critical severity, CVSS 9.8. EPSS: 68.8% chance of exploitation in the next 30 days. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at …
CVE-2020-13951, published 2020-09-30. High severity, CVSS 7.5. EPSS: 68.6% chance of exploitation in the next 30 days. Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
CVE-2016-0784, published 2016-04-11. Medium severity, CVSS 6.5. EPSS: 56.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a ..…
CVE-2016-2163, published 2016-04-11. Medium severity, CVSS 6.1. EPSS: 8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the event description when creating an event.
CVE-2016-0783, published 2016-04-11. High severity, CVSS 7.5. EPSS: 7.1% chance of exploitation in the next 30 days. The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user passwords by leveraging…
CVE-2016-2164, published 2016-04-11. High severity, CVSS 7.5. EPSS: 7% chance of exploitation in the next 30 days. The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified…
CVE-2016-3089, published 2016-08-19. Medium severity, CVSS 6.1. EPSS: 4.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the swf parameter.
CVE-2016-8736, published 2017-10-12. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.
CVE-2017-7688, published 2017-07-17. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. Apache OpenMeetings 1.0.0 updates user password in insecure manner.
CVE-2017-7685, published 2017-07-17. Medium severity, CVSS 5.3. EPSS: 2.9% chance of exploitation in the next 30 days. Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.

Latest

CVE-2026-49488, published 2026-07-14. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings. This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0. An attacker with…
CVE-2026-34020, published 2026-04-09. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query…
CVE-2026-33266, published 2026-04-09. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case…
CVE-2026-33005, published 2026-04-09. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID…
CVE-2023-29246, published 2023-05-12. High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days. An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
CVE-2023-29032, published 2023-05-12. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before…
CVE-2023-28936, published 2023-05-12. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
CVE-2023-28326, published 2023-03-28. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room
CVE-2021-27576, published 2021-03-15. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0