Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: qgis Clear all filters
TI-2026-19734 CVE-2026-24480

QGIS had validated RCE and Repository Takeover via GitHub Actions

Priority HIGH 73

QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks" that, before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9,…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00454 Published 2026-01-27 Fixed in 76a693c CWE-863
TI-2025-10245 CVE-2025-11183 · GHSA-gxp8-m5rq-3m38

Cross-Site Scripting Vulnerability in QWC2

Priority MEDIUM 64

Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page

CVSS 4.0MEDIUM 6.9 Network High privileges User interaction EPSS 0.00424 Published 2025-10-13 Fixed in 2025.08.14, 2025.8.14 CWE-79