Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: aces Component: Loris Clear all filters
TI-2026-28839 CVE-2026-39985

LORIS has an open redirect field on login

Priority LOW 27

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00207 Published 2026-04-09 Fixed in 27.0.3, 28.0.1 CWE-601
TI-2026-27577 CVE-2026-35446

LORIS has a path traversal in FilesDownloadHandler

Priority LOW 37

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00235 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-552
TI-2026-27539 CVE-2026-35403

LORIS has potential cross-site scripting in survey_accounts module

Priority LOW 28

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00173 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-79
TI-2026-27536 CVE-2026-35400

LORIS incorrectly trusts user input in publication module

Priority LOW 19

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-59
TI-2026-27323 CVE-2026-35169

LORIS has potential cross-site scripting in help_editor module

Priority LOW 39

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.0016 Published 2026-04-08 Fixed in 28.0.1 CWE-552
TI-2026-27319 CVE-2026-35165

LORIS has incorrect access checks in document_repository

Priority LOW 28

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00168 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-639
TI-2026-27207 CVE-2026-34985

LORIS has incorrect access checks in media module

Priority LOW 28

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0023 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-639
TI-2026-26678 CVE-2026-34392

LORIS has a path traversal in static router

Priority LOW 38

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00254 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-552
TI-2026-25756 CVE-2026-33350

LORIS has a SQL injection in MRI feedback popup

Priority LOW 38

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0025 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-89
TI-2026-21464 CVE-2026-26985

LORIS vulnerable to path traversal in electrophysiology_browser

Priority LOW 37

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00388 Published 2026-02-25 Fixed in 26.0.5, 27.0.2 CWE-22
TI-2026-21463 CVE-2026-26984

LORIS media module vulnerable to remote code execution

Priority MEDIUM 41

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0077 Published 2026-02-25 Fixed in 26.0.5, 27.0.2 CWE-22