Glpi-Project GLPI

• CVE-2026-53631 Medium 5.3 GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds 0.2%
• CVE-2026-47678 High 8.7 GLPI: Blind Time based SQLI in dropdowns 0.2%
• CVE-2026-52848 Critical 9.2 GLPI: MFA bypass 0.4%
• CVE-2026-57152 High 7.1 GLPI: Unallowed notifications sending 0.2%
• CVE-2026-121559 High 7.2 GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning 0.5%
• CVE-2026-108726 Medium 4.3 GLPI through 12.0.0 Missing Authorization via ajax/map.php 0.3%
• CVE-2026-53629 High 7.1 GLPI: SQL injection in history tab 1.0%
• CVE-2026-53626 High 7.1 GLPI: Arbitrary Document Read via Form Context Authorization Bypass 0.3%
• CVE-2026-48482 Critical 9.4 GLPI: RCE via Form import 0.3%
• CVE-2026-53625 High 7.5 GLPI: Privilege Escalation via authtype API manipulation 0.6%
• CVE-2026-53610 High 7.5 GLPI: Reflected XSS in dashboards 0.4%
• CVE-2026-47679 High 8.5 GLPI: arbitrary file deletion 0.3%
• CVE-2026-55214 High 8.5 GLPI: Stored XSS in suppliers 0.3%
• CVE-2026-49470 High 7.7 GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force 0.4%
• CVE-2026-55217 Medium 5.3 GLPI: Unallowed modfication of knowbase items comments and translations 0.3%
• CVE-2026-53628 Medium 5.9 GLPI: Unallowed authentication method update by administrator 0.5%
• CVE-2026-45801 Medium 5.3 GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) 0.3%
• CVE-2026-53627 Medium 6.0 GLPI: Unexpected access to update operations through the API 0.3%
• CVE-2026-49469 Medium 4.6 GLPI: LDAP filter injection in user import feature 0.4%
• CVE-2026-13490 Low 3.7 glpi-project glpi Document document.send.php canViewFile authorization 0.5%
• CVE-2026-42321 High 8.4 GLPI has stored XSS in asset locks 0.3%
• CVE-2026-42320 Medium 5.9 GLPI vulnerable to arbitrary file access 0.2%
• CVE-2026-42318 High 7.0 GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint 0.3%
• CVE-2026-42317 High 7.0 GLPI vulnerable to arbitrary files deletion by technician 0.3%
• CVE-2026-44281 High 7.0 GLPI vulnerable to unauthorized reading of a specific asset object 0.3%
• CVE-2026-40108 High 7.1 GLPI Vulnerable to Stored XSS in ITIL Costs 0.3%
• CVE-2026-5385 High 8.4 GLPI 11.0.0 - Stored XSS in knowledge base 0.4%
• CVE-2026-32312 Medium 5.1 GLPI: Unauthorized export of form structure 0.2%
• CVE-2026-29047 High 7.2 GLPI has an Authenticated SQL Injection via log exports 0.4%
• CVE-2026-26263 High 8.1 GLPI has an Unauthenticated SQL Injection via Search engine 8.4%
• CVE-2026-26027 High 7.5 GLPI has an Unauthenticated Stored XSS via inventory 0.2%
• CVE-2026-26026 Critical 9.1 GLPI has a Server-Side Template Injection via Double-Compilation 12.0%
• CVE-2026-25932 High 7.2 GLPI has Stored XSS in Supplier 'Website' field 0.3%
• CVE-2026-25937 Medium 6.5 GLPI has a MFA bypass 0.3%
• CVE-2026-25936 Medium 6.5 GLPI Vulnerable to Authenticated SQL Injection 0.4%
• CVE-2026-22248 High 8.1 GLPI affected by Remote Code Execution via malicious upload 0.4%
• CVE-2026-22044 Medium 6.5 GLPI is Vulnerable to Authenticated SQL Injection 0.3%
• CVE-2026-23624 Medium 4.3 GLPI is vulnerable to session stealing on externally authenticated user change 0.4%
• CVE-2026-22247 Medium 4.1 GLPI is Vulnerable to SSRF via Webhooks 0.4%
• CVE-2025-66417 High 7.5 GLPI has an unauthenticated SQL injection through the inventory endpoint 0.5%
• CVE-2025-64516 High 7.5 GLPI incorrectly authorizes access to documents 0.3%
• CVE-2023-53943 Medium 5.3 GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint 0.4%
• CVE-2025-64520 Medium 6.5 GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API 0.2%
• CVE-2025-59935 Medium 6.5 GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page 0.3%
• CVE-2025-53105 High 7.5 GLPI permits unauthorized rules execution order 0.4%
• CVE-2025-53357 Medium 5.4 GLPI permits reservation modification by unauthorized users 0.2%
• CVE-2025-53113 Low 2.7 GLPI technicians can access unauthorized information through external links 0.3%
• CVE-2025-53112 Medium 4.3 GLPI's incomprehensive permission checks can lead to data removal from allowed users 0.2%
• CVE-2025-53111 Medium 6.5 GLPI exposes data to non-allowed users 0.3%
• CVE-2025-53008 Medium 6.5 GLPI's MailCollector Receiver is vulnerable to credential exfiltration 0.3%