LLeantime

Products

Exploited and recent CVEs

• CVE-2026-85990 High 8.8 Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods 0.4%
• CVE-2026-92772 High 7.1 Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX 0.5%
• CVE-2026-76647 High 8.8 Leantime JSON-RPC API contains a missing authorization vulnerability 0.5%
• CVE-2026-54418 High 8.1 Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass 0.4%
• CVE-2026-66416 High 8.8 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware 0.3%
• CVE-2026-66415 High 8.5 Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import() 0.4%
• CVE-2026-66414 Medium 6.1 Leantime Open Redirect in Login Controller via redirectUrl Parameter 0.3%
• CVE-2026-66412 Medium 6.5 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC 0.4%
• CVE-2026-59712 High 8.1 Leantime - JSON-RPC API Broken Access Control via users.getUser 0.4%
• CVE-2026-59713 High 8.1 Leantime - OIDC Login CSRF via Unconditional State Verification Stub 0.2%
• CVE-2023-45826 Medium 6.5 Authenticated SQL Injection in leantime 2.1%
• CVE-2023-33961 High 8.9 Leantime Stored Cross-site Scripting Vulnerability 0.4%
• CVE-2020-5292 High 8.7 Time-based blind injection in Leantime 1.4%