Vulnerabilities

TI-2026-36594 CVE-2026-49436

LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API

HIGH 67

LinkAce is a self-hosted archive to collect website links.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00367 Published 2026-08-20 Fixed in 2.5.7 CWE-79

TI-2026-33136 CVE-2026-45342

LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes

MEDIUM 64

LinkAce is a self-hosted archive to collect website links.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00225 Published 2026-05-28 Fixed in 2.5.6 CWE-639

TI-2026-33137 CVE-2026-45343

LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session Hijacking

HIGH 72

LinkAce is a self-hosted archive to collect website links.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00306 Published 2026-05-28 Fixed in 2.5.6 CWE-79

TI-2026-33138 CVE-2026-45344

LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances

HIGH 70

LinkAce is a self-hosted archive to collect website links.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00456 Published 2026-05-28 Fixed in 2.5.6 CWE-74

TI-2026-29561 CVE-2026-40905

LinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover

LOW 37

LinkAce is a self-hosted archive to collect website links.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00288 Published 2026-04-21 Fixed in 2.5.4 CWE-601

TI-2026-27633 CVE-2026-35516

LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection

MEDIUM 56

LinkAce is a self-hosted archive to collect website links.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00285 Published 2026-04-07 Fixed in 2.5.4 CWE-918

TI-2026-26304 CVE-2026-33954

LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

MEDIUM 62

LinkAce is a self-hosted archive to collect website links.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00324 Published 2026-03-27 Fixed in 2.5.3 CWE-285

TI-2026-26303 CVE-2026-33953

LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce

HIGH 70

LinkAce is a self-hosted archive to collect website links.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00279 Published 2026-03-27 Fixed in 2.5.3 CWE-918

TI-2026-23779 CVE-2026-30954

LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy()

LOW 24

LinkAce is a self-hosted archive to collect website links.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00234 Published 2026-03-10 No fix listed CWE-639

TI-2026-23778 CVE-2026-30953

LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest

HIGH 67

LinkAce is a self-hosted archive to collect website links.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00253 Published 2026-03-10 No fix listed CWE-918

TI-2026-21865 CVE-2026-27458

LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description

HIGH 79

LinkAce is a self-hosted archive to collect website links.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00251 Published 2026-02-21 Fixed in 2.4.3 CWE-80

TI-2025-38912 CVE-2025-62722

LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature

HIGH 73

LinkAce is a self-hosted archive to collect website links.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00262 Published 2025-11-04 Fixed in 2.4.0 CWE-79

TI-2025-38911 CVE-2025-62721

LinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and Tags

MEDIUM 64

LinkAce is a self-hosted archive to collect website links.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00393 Published 2025-11-04 Fixed in 2.4.0 CWE-200

TI-2025-38910 CVE-2025-62720

LinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private Links

MEDIUM 64

LinkAce is a self-hosted archive to collect website links.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00396 Published 2025-11-04 Fixed in 2.4.0 CWE-200

TI-2025-38909 CVE-2025-62719

LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality

MEDIUM 45

LinkAce is a self-hosted archive to collect website links.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00333 Published 2025-11-04 Fixed in 2.4.0 CWE-918

TI-2025-36976 CVE-2025-59424

LinkAce Vulnerable to Stored XSS on the Audit Page

HIGH 67

LinkAce is a self-hosted archive to collect website links.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00352 Published 2025-09-18 Fixed in 2.3.1 CWE-79

TI-2025-33730 CVE-2025-53838

LinkAce has a Stored One Click XSS vulnerability

HIGH 72

LinkAce is a self-hosted archive to collect website links.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00273 Published 2025-09-08 Fixed in 2.1.9 CWE-79

TI-2024-37395 CVE-2024-56508

File Upload Vulnerability Leading to XSS in LinkAce v1.15.5

HIGH 66

LinkAce is a self-hosted archive to collect links of your favorite websites.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00436 Published 2024-12-27 Fixed in 1.15.6 CWE-434

TI-2024-37394 CVE-2024-56507

Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce

MEDIUM 58

LinkAce is a self-hosted archive to collect links of your favorite websites.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.003 Published 2024-12-27 Fixed in 1.15.6 CWE-79

Vulnerabilities

Filters