Read the docs

aces

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

aces records in CISA KEV

No aces vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Loris 11 records MEDIUM

Records

13 records

TI-2026-21463 CVE-2026-26984

LORIS media module vulnerable to remote code execution

Priority MEDIUM 41

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0077 Published 2026-02-25 Fixed in 26.0.5, 27.0.2 CWE-22
TI-2026-27323 CVE-2026-35169

LORIS has potential cross-site scripting in help_editor module

Priority LOW 39

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.0016 Published 2026-04-08 Fixed in 28.0.1 CWE-552
TI-2026-26678 CVE-2026-34392

LORIS has a path traversal in static router

Priority LOW 38

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00254 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-552
TI-2026-25756 CVE-2026-33350

LORIS has a SQL injection in MRI feedback popup

Priority LOW 38

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0025 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-89
TI-2026-27577 CVE-2026-35446

LORIS has a path traversal in FilesDownloadHandler

Priority LOW 37

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00235 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-552
TI-2026-21464 CVE-2026-26985

LORIS vulnerable to path traversal in electrophysiology_browser

Priority LOW 37

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00388 Published 2026-02-25 Fixed in 26.0.5, 27.0.2 CWE-22
TI-2026-27539 CVE-2026-35403

LORIS has potential cross-site scripting in survey_accounts module

Priority LOW 28

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00173 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-79
TI-2026-27319 CVE-2026-35165

LORIS has incorrect access checks in document_repository

Priority LOW 28

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00168 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-639
TI-2026-27207 CVE-2026-34985

LORIS has incorrect access checks in media module

Priority LOW 28

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0023 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-639
TI-2026-83419 CVE-2026-55147

LORIS imaging browser API lacks edit authorization checks

Priority LOW 27

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-10-30 Fixed in 27.0.4, 28.0.2 CWE-862
TI-2026-28839 CVE-2026-39985

LORIS has an open redirect field on login

Priority LOW 27

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00207 Published 2026-04-09 Fixed in 27.0.3, 28.0.1 CWE-601
TI-2026-83418 CVE-2026-55146

Missing authorization in LORIS issue tracker lets users edit issues

Priority LOW 19

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00213 Published 2026-10-30 Fixed in 27.0.4, 28.0.2 CWE-862
TI-2026-27536 CVE-2026-35400

LORIS incorrectly trusts user input in publication module

Priority LOW 19

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-59
Open these records in search →