Затронутые ветки версий
Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2026-85990 | Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods | * | 8.8 | — | 2026-10-14 | |
| CVE-2026-92772 | Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX | < 3.9.6 | 7.1 | — | 2026-09-17 | |
| CVE-2026-54418 | Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypa... | ≤ 3.6.2 | 8.1 | — | 2026-08-05 | |
| CVE-2026-66416 | Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware | ≤ 3.6.2 | 8.6 | — | 2026-07-31 | |
| CVE-2026-66415 | Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import() | ≤ 3.6.2 | 8.4 | — | 2026-07-31 | |
| CVE-2026-66414 | Leantime Open Redirect in Login Controller via redirectUrl Parameter | ≤ 3.6.2 | 5.1 | — | 2026-07-31 | |
| CVE-2026-66412 | Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC | ≤ 3.6.2 | 7.1 | — | 2026-07-27 | |
| CVE-2026-59712 | Leantime - JSON-RPC API Broken Access Control via users.getUser | ≤ 3.4.4 | 8.6 | — | 2026-07-07 | |
| CVE-2026-59713 | Leantime - OIDC Login CSRF via Unconditional State Verification Stub | ≤ 3.4.4 | 8.6 | — | 2026-07-07 | |
| CVE-2025-28254 | Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute a... | * | 5.4 | — | 2025-03-28 | |
| CVE-2024-27476 | Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. | * | 4.7 | — | 2024-04-10 | |
| CVE-2024-27474 | Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors... | * | 8.8 | — | 2024-04-10 | |
| CVE-2024-27477 | In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification fun... | * | 6.1 | — | 2024-04-10 | |
| CVE-2023-45826 | Authenticated SQL Injection in leantime | * | 6.5 | — | 2023-10-20 | |
| CVE-2023-33961 | Leantime Stored Cross-site Scripting Vulnerability | * | 8.9 | — | 2023-05-31 | |
| CVE-2020-5292 | Time-based blind injection in Leantime | * | 8.7 | — | 2020-04-01 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).