Affects Apache Roller 6.1.5. CVE-2026-82384: unauth XML-RPC deserializes vendor extension types pre-auth → RCE even if XML-RPC disabled. CVE-2026-82377: XML-RPC Blogger/MetaWeblog missing per-weblog authz → cross-weblog read/modify/delete when XML-RPC enabled. CVE-2026-82378: OAuth 1.0a auth binds token via request value (unsigned) → account bind/takeover if request token known. CVE-2026-82379: WSSE AtomPub replay (no nonce/timestamp checks) when AtomPub+WSSE enabled. CVE-2026-82380: CSRF filter accepts server-generated salt → state changes via crafted page. CVE-2026-82383: post-install setup action unauth changes global frontpage weblog. CVE-2026-82386: OPML import XXE → file read/SSRF. CVE-2026-82376: trackback response XXE → file read. CVE-2026-82375: trackback/enclosure SSRF → internal/loopback HTTP. CVE-2026-82348: unscoped IDs enable cross-weblog resource edits; template overwrite injects Velocity evaluated on render. Upgrade to 6.1.6+ to mitigate.