basecamp

Products

Exploited and recent CVEs

• CVE-2026-100355 Low 3.1 Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard 0.3%
• CVE-2026-73426 Medium 4.6 Trix: Stored XSS vulnerability through serialized attributes 0.3%
• CVE-2026-73428 Medium 4.6 Trix: Stored XSS via HTMLParser attribute injection on paste 0.4%
• CVE-2026-73427 Low 2.1 Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController) 0.6%
• CVE-2025-58067 Medium 4.2 Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI 0.2%
• CVE-2025-57821 Medium 4.2 Basecamp's Google Sign-In for Rails allowed redirects to a malformed URL 0.2%
• CVE-2025-46812 Low 2.0 Trix vulnerable to Cross-site Scripting on copy & paste 0.7%
• CVE-2025-21610 Medium 5.3 Trix allows Cross-site Scripting via `javascript:` url in a link 0.4%
• CVE-2024-53847 Medium 5.1 Trix vulnerable to Cross-site Scripting on copy & paste 0.5%
• CVE-2024-43368 Medium 6.5 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste 0.5%
• CVE-2024-34341 Medium 5.4 The Trix Editor Contains an Arbitrary Code Execution Vulnerability 0.8%