Bbestpractical

Products

Exploited and recent CVEs

• CVE-2026-44230 Medium 6.1 RT: Reflected Cross-Site Scripting in search results chart 0.2%
• CVE-2026-44231 Critical 9.1 RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint 0.2%
• CVE-2026-44229 Medium 5.4 RT: Cross-Site Scripting via inline-served uploaded content 0.1%
• CVE-2026-44228 Medium 5.4 RT: Stored Cross-Site Scripting via insufficient template escaping 0.3%
• CVE-2026-44227 Medium 6.1 RT: Reflected Cross-Site Scripting via URL parameters 0.3%
• CVE-2026-41076 High 8.1 RT: LDAP authentication bypass via empty password 0.4%
• CVE-2026-41075 High 8.8 RT: SQL injection via entry_aggregator parameter in JSON search 0.3%
• CVE-2026-41074 High 7.1 RT has broken CSRF protection for authenticated users 0.1%
• CVE-2026-41073 Medium 4.6 RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps 0.2%
• CVE-2025-61873 Low 2.6 Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used. 0.2%
• CVE-2025-31501 High 7.2 Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink. 0.3%
• CVE-2025-31500 High 7.2 Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name. 0.3%
• CVE-2025-30087 High 7.2 Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL. 0.3%