Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: oqtane Clear all filters
TI-2026-85079 CVE-2026-122008 · GHSA-p838-xx56-rf99

Server-side request forgery in Oqtane Framework file upload from URL

Priority LOW 24

Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by su…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00259 Published 2026-11-04 Fixed in 10.3.0 CWE-918
TI-2026-85078 CVE-2026-122007 · GHSA-mq53-5f2v-2rj6

Broken access control in Oqtane Framework settings API exposes other sites

Priority LOW 35

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same t…

CVSS 4.0HIGH 7.4 Network High privileges No interaction EPSS 0.00383 Published 2026-11-04 Fixed in 10.3.0 CWE-639
TI-2026-75402 CVE-2026-111616 · GHSA-cc9f-f98j-3ppq

Authorization bypass in Oqtane exposes other sites' SMTP secrets

Priority LOW 30

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00346 Published 2026-10-16 No fix listed CWE-639