CVE-2026-49832High· 8.0▾ TwilightDSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.dspace:dspace-api >= 8.0-rc1, < 8.4org.dspace:dspace-api >= 9.0-rc1, < 9.3org.dspace:dspace-api = 10.0-rc1Patched in:
org.dspace:dspace-api 8.4org.dspace:dspace-api 9.3org.dspace:dspace-api 10.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14576High· 7.8Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick
CVE-2026-49831Medium· 5.5DSpace open source software is a repository application which provides durable access to digital resources
CVE-2026-49830Medium· 4.4DSpace open source software is a repository application which provides durable access to digital resources
CVE-2026-49833Medium· 5.5DSpace open source software is a repository application which provides durable access to digital resources
CVE-2025-13786High· 7.3A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665
CVE-2022-34821High· 7.6A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE M804PB (6GK5804-0AP00-2AA2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2), SCALANCE …