GROWI, Inc. GROWI

• CVE-2026-115624 Medium 5.3 GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user i 0.2%
• CVE-2026-109848 Medium 4.2 GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can l 0.2%
• CVE-2026-105272 Medium 4.2 GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated a 0.2%
• CVE-2026-100727 Medium 5.3 An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is co 0.2%
• CVE-2026-53620 Medium 6.3 GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tampe 0.3%
• CVE-2026-68951 Medium 5.3 GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data. 0.3%
• CVE-2026-80191 High 7.5 GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests 0.5%
• CVE-2026-41951 High 7.2 Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI. 0.5%
• CVE-2026-41040 High 7.5 GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string. 0.4%
• CVE-2026-26291 Medium 5.4 Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user's web browser. 0.2%
• CVE-2026-25083 High 8.3 GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant's identifier may view and/or tamper t 0.3%
• CVE-2025-64700 Medium 4.3 Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations. 0.1%
• CVE-2025-61994 Medium 5.4 Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim 0.2%
• CVE-2025-54806 Medium 6.1 GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be 0.2%
• CVE-2025-43880 Medium 4.3 Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition. 0.3%