Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: Camunda Clear all filters
TI-2026-76422 CVE-2026-109433 · GHSA-cm9q-c667-7h4q

Broken access control in Camunda Cockpit exposes process data

Priority MEDIUM 60

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison l…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00434 Published 2026-10-19 Fixed in 7.24.16, 7.23.17 CWE-863
TI-2026-76421 CVE-2026-109432 · GHSA-mqfw-m4cx-w4jp

Expression injection in Camunda 7 orQueries enables command execution

Priority HIGH 81

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by T…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00558 Published 2026-10-19 Fixed in 7.24.14, 7.23.17 CWE-78
TI-2026-76420 CVE-2026-109431 · GHSA-9vfr-59xg-h3vg

Missing authorization in Camunda task comments and attachments

Priority HIGH 72

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00359 Published 2026-10-19 Fixed in 7.24.14, 7.23.17 CWE-639
TI-2026-68026 CVE-2026-77226 · GHSA-mx4r-g275-wg5r

Incorrect authorization in Camunda 7 setup lets attackers add admins

Priority HIGH 75

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only dire…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00693 Published 2026-10-05 Fixed in 7.24.15 CWE-863
TI-2024-34492 CVE-2024-51577 · GHSA-3xg4-jv8r-rx3h

WordPress bpmn.io plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in neville.lugton bpmn.io bpmnio allows Stored XSS.This issue affects bpmn.io: from n/a through <= 1.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00254 Published 2024-11-10 No fix listed CWE-79
TI-2021-06144 CVE-2021-23460 · GHSA-2m53-83f3-562j

Prototype pollution in min-dash

Priority LOW 37

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0219 Published 2022-01-21 Fixed in 3.8.1 CWE-1321