# org.apache.openmeetings:openmeetings-parent (Maven) vulnerabilities 25 known vulnerabilities (2 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 9.1.0 (Jul 13, 2026): no advisory affects it - Newest unaffected release: 9.1.0 (Jul 13, 2026), the latest release - Dependents: 0 - Releases: 33 since 3.1.2 (Aug 15, 2016) - Registry: https://central.sonatype.com/artifact/org.apache.openmeetings/openmeetings-parent - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-33005: 4.0.0 to 8.1.0 (9.0.0 is outside it) - CVE-2026-33266: 6.2.0 to 8.1.0 (9.0.0 is outside it) - CVE-2026-34020: 3.1.3 to 8.1.0 (9.0.0 is outside it) - CVE-2024-54676: 3.1.2 to 7.2.0 (8.0.0 is outside it) - CVE-2023-29032: 3.1.3 to 7.0.0 (7.2.0 is outside it) - CVE-2023-29246: 3.1.2 to 7.0.0 (7.2.0 is outside it) - CVE-2023-28326: 3.1.2 to 6.3.0 (7.0.0 is outside it) - CVE-2021-27576: 4.0.0 to 5.1.0 (6.2.0 is outside it) - CVE-2020-13951: 4.0.0 to 5.0.0 (5.1.0 is outside it) - CVE-2018-1286: 3.1.2 to 4.0.1 (4.0.3 is outside it) - CVE-2016-8736: no published release is affected - CVE-2017-7688: 3.1.2 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7685: 3.1.2 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7684: 3.1.2 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7683: 3.1.2 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7682: 3.2.0 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7681: 3.1.2 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7680: 3.1.2 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7673: 3.1.2 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7666: 3.1.2 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7664: 3.1.2 to 3.2.1 (3.3.0 is outside it) - CVE-2017-7663: 3.2.0 to 3.2.1 (3.3.0 is outside it) - CVE-2016-3089: no published release is affected - CVE-2016-2164: no published release is affected - CVE-2016-2163: no published release is affected ## Advisories (25) ### [CVE-2026-33005](https://cve.now/CVE-2026-33005): Apache OpenMeetings: Insufficient checks in FileWebService - Severity: Medium 4.3 - Published: Apr 9, 2026 - Affected: from 3.10, fixed in 9.0.0. - Fixed in 9.0.0 (released Apr 5, 2026, 4 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2026-33266](https://cve.now/CVE-2026-33266): Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt - Severity: High 7.5 - Published: Apr 9, 2026 - Affected: from 6.1.0, fixed in 9.0.0. - Fixed in 9.0.0 (released Apr 5, 2026, 4 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2026-34020](https://cve.now/CVE-2026-34020): Apache OpenMeetings: Login Credentials Passed via GET Query Parameters - Severity: High 7.5 - Published: Apr 9, 2026 - Affected: from 3.1.3, fixed in 9.0.0. - Fixed in 9.0.0 (released Apr 5, 2026, 4 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2024-54676](https://cve.now/CVE-2024-54676): Apache OpenMeetings: Deserialisation of untrusted data in cluster mode - Severity: Critical 9.8 - Published: Jan 8, 2025 - Affected: from 2.1.0, fixed in 8.0.0. - Fixed in 8.0.0 (released Dec 29, 2024, 10 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2023-29032](https://cve.now/CVE-2023-29032): Apache OpenMeetings: allows bypass authentication - Severity: High 8.1 - Published: May 12, 2023 - Affected: from 3.1.3, fixed in 7.1.0. - Fixed in 7.2.0 (released Dec 19, 2023, 221 days after disclosure, the advisory names 7.1.0, which was never published). - The latest release, 9.1.0, is not affected. ### [CVE-2023-29246](https://cve.now/CVE-2023-29246): Apache OpenMeetings: allows null-byte Injection - Severity: High 7.2 - Published: May 12, 2023 - Affected: from 2.0.0, fixed in 7.1.0. - Fixed in 7.2.0 (released Dec 19, 2023, 221 days after disclosure, the advisory names 7.1.0, which was never published). - The latest release, 9.1.0, is not affected. ### [CVE-2023-28326](https://cve.now/CVE-2023-28326): Apache OpenMeetings: allows user impersonation - Severity: Critical 9.8 - Published: Mar 28, 2023 - Affected: from 2.0.0, fixed in 7.0.0. - Fixed in 7.0.0 (released Feb 7, 2023, 49 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2021-27576](https://cve.now/CVE-2021-27576): Apache OpenMeetings: bandwidth can be overloaded with public web service - Severity: Unrated - Published: Mar 15, 2021 - Affected: from 4.0.0, fixed in 6.0.0. - Fixed in 6.2.0 (released Apr 27, 2022, 408 days after disclosure, the advisory names 6.0.0, which was never published). - The latest release, 9.1.0, is not affected. ### [CVE-2020-13951](https://cve.now/CVE-2020-13951): Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack. - Severity: Unrated - Published: Sep 30, 2020 - Affected: from 4.0.0, fixed in 5.1.0. - Fixed in 5.1.0 (released Dec 1, 2020, 62 days after disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2018-1286](https://cve.now/CVE-2018-1286): In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to… - Severity: Unrated - Published: Feb 28, 2018 - Affected: from 3.0.0, fixed in 4.0.2. - Fixed in 4.0.3 (released Apr 14, 2018, 45 days after disclosure, the advisory names 4.0.2, which was never published). - The latest release, 9.1.0, is not affected. ### [CVE-2016-8736](https://cve.now/CVE-2016-8736): Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. - Severity: Unrated - Published: Oct 12, 2017 - Affected: fixed in 3.1.2. - Fixed in 3.1.2 (released Aug 15, 2016, 423 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7688](https://cve.now/CVE-2017-7688): Apache OpenMeetings 1.0.0 updates user password in insecure manner. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 1.0.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7685](https://cve.now/CVE-2017-7685): Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 1.0.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7684](https://cve.now/CVE-2017-7684): Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 1.0.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7683](https://cve.now/CVE-2017-7683): Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 1.0.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7682](https://cve.now/CVE-2017-7682): Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 3.2.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7681](https://cve.now/CVE-2017-7681): Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 1.0.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7680](https://cve.now/CVE-2017-7680): Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 1.0.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7673](https://cve.now/CVE-2017-7673): Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and… - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 1.0.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7666](https://cve.now/CVE-2017-7666): Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 1.0.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7664](https://cve.now/CVE-2017-7664): Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 3.1.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2017-7663](https://cve.now/CVE-2017-7663): Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. - Severity: Unrated - Published: Jul 14, 2017 - Affected: from 3.2.0, fixed in 3.3.0. - Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2016-3089](https://cve.now/CVE-2016-3089): Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary… - Severity: Unrated - Published: Aug 19, 2016 - Affected: fixed in 3.1.2. - Fixed in 3.1.2 (released Aug 15, 2016, 4 days before disclosure). - The latest release, 9.1.0, is not affected. ### [CVE-2016-2164](https://cve.now/CVE-2016-2164): The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1… - Severity: Unrated - Published: Apr 11, 2016 - Affected: fixed in 3.1.1. - Fixed in 3.1.2 (released Aug 15, 2016, 126 days after disclosure, the advisory names 3.1.1, which was never published). - The latest release, 9.1.0, is not affected. ### [CVE-2016-2163](https://cve.now/CVE-2016-2163): Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or… - Severity: Unrated - Published: Apr 11, 2016 - Affected: fixed in 3.1.1. - Fixed in 3.1.2 (released Aug 15, 2016, 126 days after disclosure, the advisory names 3.1.1, which was never published). - The latest release, 9.1.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.openmeetings:openmeetings-parent Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.