Read the docs

steedos

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

steedos records in CISA KEV

No steedos vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Steedos 1 record MEDIUM

Records

3 records

TI-2026-62058 CVE-2026-91922 · GHSA-925g-q5h8-6rmx

Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Priority MEDIUM 57

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00338 Published 2026-09-15 No fix listed CWE-79
TI-2020-18141 CVE-2020-35666 · GHSA-q7pj-xc3r-rm4w

Steedos Platform through 1.21.24 allows NoSQL injection because the…

Priority MEDIUM 40

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.js mishandles req.body validation, as demonstrated by MongoDB operator attacks su…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01086 Published 2020-12-23 No fix listed CWE-89
TI-2026-75452 CVE-2026-111666 · GHSA-388m-pwcw-qwh5

Cross-tenant information disclosure in Steedos Platform reports API

Priority LOW 24

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-10-16 No fix listed CWE-863
Open these records in search →