Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Vendor: aces Clear all filters
TI-2026-83418 CVE-2026-55146

Missing authorization in LORIS issue tracker lets users edit issues

Priority LOW 19

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00213 Published 2026-10-30 Fixed in 27.0.4, 28.0.2 CWE-862
TI-2026-83419 CVE-2026-55147

LORIS imaging browser API lacks edit authorization checks

Priority LOW 27

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-10-30 Fixed in 27.0.4, 28.0.2 CWE-862
TI-2026-28839 CVE-2026-39985

LORIS has an open redirect field on login

Priority LOW 27

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00207 Published 2026-04-09 Fixed in 27.0.3, 28.0.1 CWE-601
TI-2026-27577 CVE-2026-35446

LORIS has a path traversal in FilesDownloadHandler

Priority LOW 37

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00235 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-552
TI-2026-27539 CVE-2026-35403

LORIS has potential cross-site scripting in survey_accounts module

Priority LOW 28

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00173 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-79
TI-2026-27536 CVE-2026-35400

LORIS incorrectly trusts user input in publication module

Priority LOW 19

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-59
TI-2026-27323 CVE-2026-35169

LORIS has potential cross-site scripting in help_editor module

Priority LOW 39

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.0016 Published 2026-04-08 Fixed in 28.0.1 CWE-552
TI-2026-27319 CVE-2026-35165

LORIS has incorrect access checks in document_repository

Priority LOW 28

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00168 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-639
TI-2026-27207 CVE-2026-34985

LORIS has incorrect access checks in media module

Priority LOW 28

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0023 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-639
TI-2026-26678 CVE-2026-34392

LORIS has a path traversal in static router

Priority LOW 38

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00254 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-552
TI-2026-25756 CVE-2026-33350

LORIS has a SQL injection in MRI feedback popup

Priority LOW 38

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0025 Published 2026-04-08 Fixed in 27.0.3, 28.0.1 CWE-89
TI-2026-21464 CVE-2026-26985

LORIS vulnerable to path traversal in electrophysiology_browser

Priority LOW 37

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00388 Published 2026-02-25 Fixed in 26.0.5, 27.0.2 CWE-22
TI-2026-21463 CVE-2026-26984

LORIS media module vulnerable to remote code execution

Priority MEDIUM 41

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0077 Published 2026-02-25 Fixed in 26.0.5, 27.0.2 CWE-22