Enalean tuleap

• CVE-2026-24007 Medium 4.6 Tuleap is missing CSRF protection in the Overview inconsistent items 0.2%
• CVE-2025-65962 Medium 4.6 Tuleap has missing CSRF protections its in tracker field dependencies 0.2%
• CVE-2025-64760 Medium 4.6 Tuleap has missing CSRF protections in its tracker trigger management system 0.1%
• CVE-2025-64499 Medium 4.6 Tuleap is missing CSRF protections for its planning management API 0.1%
• CVE-2025-64498 Medium 4.6 Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability 0.1%
• CVE-2025-64497 Medium 6.5 Tuleap exposes releases for all projects to File Release System project administrators 0.3%
• CVE-2025-64482 Medium 4.6 Tuleap missing CSRF protections in the File Release System 0.1%
• CVE-2025-64117 Medium 4.6 Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags 0.1%
• CVE-2025-59040 Medium 4.3 Tuleap backlog item representations do not verify the permissions of the child trackers 0.3%
• CVE-2025-54877 Medium 5.3 Tuleap's special and always there fields permissions are not verified in cross-tracker search 0.3%
• CVE-2025-53902 Medium 4.3 Tuleap exposes artifacts to a mentioned user via email notifications 0.4%
• CVE-2025-53541 Medium 5.4 Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifact 0.3%
• CVE-2025-52899 Medium 5.3 Tuleap vulnerable to user enumeration via the lost password form 0.3%
• CVE-2025-50179 Medium 4.6 Tuleap missing CSRF protection on tracker reports manipulation 0.2%
• CVE-2025-48991 Medium 4.6 Tuleap missing CSRF protection on tracker canned responses administration 0.2%
• CVE-2025-30155 Medium 4.3 Tuleap does not enforce read permissions on parent trackers in the REST API 0.3%
• CVE-2025-30209 Medium 5.3 Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin 0.4%
• CVE-2025-30203 Medium 4.8 Tuleap allows XSS via the content of RSS feeds in the RSS widgets 0.3%
• CVE-2025-29929 Medium 4.6 Tuleap is missing CSRF protection on tracker hierarchy administration 0.2%
• CVE-2025-29766 Medium 4.6 Tuleap has missing CSRF protections on artifact submission & edition from the tracker view 0.2%
• CVE-2025-27402 Medium 4.6 Tuleap is missing CSRF protections on tracker fields administrative operations 0.2%
• CVE-2025-27401 Medium 4.6 In Tuleap, deleting a report can delete criteria filters in other reports 0.3%
• CVE-2025-27156 Medium 4.1 Tuleap allows content injection via emails sent by the mass emailing features 0.3%
• CVE-2025-27150 Medium 5.3 Tuleap dumps the Redis password into the generated troubleshooting archives 0.4%
• CVE-2025-27099 Medium 4.8 Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message 0.3%
• CVE-2025-27094 Medium 5.4 Tuleap allows default values to be cleared from field configuration 0.4%
• CVE-2025-22129 Medium 4.3 Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap 0.3%
• CVE-2025-24029 Medium 5.3 Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap 0.4%
• CVE-2024-52599 Medium 5.4 Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin 0.3%
• CVE-2024-47767 Medium 4.3 Tuleap lists trackers in the quick add actions of the backlog without any permissions check 0.4%
• CVE-2024-47766 Medium 4.9 Permissions are incorrectly verified for project administrators in the cross tracker search widget 0.5%
• CVE-2024-46988 Medium 4.8 Tuleap does not properly check permissions for email notifications in trackers 0.4%
• CVE-2024-46980 Medium 4.8 Tuleap vulnerable to XSS in the HTML mail content of the cross reference field 0.4%
• CVE-2024-39902 Medium 4.8 Tuleap's recursive permissions to document manager folder are not properly applied 0.3%
• CVE-2024-37167 Medium 4.3 Tuleap has improper permissions of the backlog items 0.4%
• CVE-2024-30246 High 7.6 Tuleap deleting or moving an artifact can delete values from unrelated artifacts 0.6%
• CVE-2024-25130 Medium 5.4 Tuleap's mass update clears the permissions on artifact field 0.5%
• CVE-2024-23344 Medium 5.3 Tuleap's content of artifacts might be readable by unauthorized users 0.5%
• CVE-2023-48715 Medium 5.4 Tuleap vulnerable to Cross-site Scripting on the edition page of a release 0.5%
• CVE-2023-39521 Medium 4.8 Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion 0.6%
• CVE-2023-38508 Medium 6.5 Tuleap allows preview of a linked artifact with a type does not respect permissions 0.7%
• CVE-2023-35929 Medium 5.4 Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps 0.5%
• CVE-2023-35938 Medium 4.1 User access not updated with privilege change in Tuleap 0.6%
• CVE-2023-32072 Medium 4.8 Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job 0.5%
• CVE-2023-30619 Medium 5.4 XSS in the tooltip via an artifact title 0.5%
• CVE-2023-23938 Medium 5.9 Cross-site Scripting (XSS) through the name of a color of select box values in tuleap 0.5%
• CVE-2022-23473 Medium 4.3 Tuleap MediaWiki standalone "readers" can also edit pages 0.5%
• CVE-2022-46160 Medium 4.3 Tuleap dashboards vulnerable to Incorrect Authorization 0.5%
• CVE-2022-39233 Medium 4.3 Tuleap subject to Missing Authorization allowing for branch prefix modification 0.8%
• CVE-2022-31128 Medium 5.4 Fine grained permissions are not checked in Tuleap 0.7%