Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: ConnectWise Component: Professional Service Automation Clear all filters
TI-2026-00488 CVE-2026-0696 · GHSA-499f-rpfh-94vx

Session Cookies Missing HttpOnly Attribute

Priority LOW 29

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00392 Published 2026-01-16 Fixed in 2026.1 CWE-1004
TI-2026-00487 CVE-2026-0695 · GHSA-gpp2-hwq5-2xp4

Stored XSS in Time Entry Audit Trail

Priority LOW 39

In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.0028 Published 2026-01-16 Fixed in 2026.1 CWE-79
TI-2025-06564 CVE-2025-7204 · GHSA-v9mv-65w9-g7fv

Exposure of password hashes via API responses in ConnectWise PSA

Priority LOW 29

In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00356 Published 2025-07-09 Fixed in 2025.9 CWE-201