Read the docs

GBIF

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

GBIF records in CISA KEV

No GBIF vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-50194 CVE-2026-71879 · GHSA-25rh-cr4w-2wx6

Authentication bypass in Integrated Publishing Toolkit

Priority MEDIUM 43

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via a…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00858 Published 2026-08-18 Fixed in 3.3.4 CWE-288
TI-2026-50193 CVE-2026-71878 · GHSA-9cwq-xr29-c4rp

Authentication bypass in Integrated Publishing Toolkit

Priority MEDIUM 43

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00858 Published 2026-08-18 Fixed in 3.3.4 CWE-306
TI-2026-50195 CVE-2026-71880 · GHSA-xf73-gxc6-65vv

Server-side template injection in Integrated Publishing Toolkit

Priority LOW 36

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.0048 Published 2026-08-18 Fixed in 3.3.4 CWE-1336
TI-2026-86162 CVE-2026-71881 · GHSA-xcpx-4ghq-5cp2

Cross-site scripting in GBIF Integrated Publishing Toolkit

Priority LOW 22

Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00415 Published 2026-11-06 Fixed in 3.3.5 CWE-79
Open these records in search →