CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 21/10/2026 |
| CVE-2026-114399 | MEDIO6.5 | Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths out | 21/10/2026 |
| CVE-2026-114398 | MEDIO5.4 | Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from | 21/10/2026 |
| CVE-2026-114397 | ALTO7.4 | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'. | 21/10/2026 |
| CVE-2026-114396 | ALTO7.1 | Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documen | 21/10/2026 |
| CVE-2026-114395 | MEDIO4.3 | Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversation | 21/10/2026 |
| CVE-2026-114394 | MEDIO4.3 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments | 21/10/2026 |
| CVE-2026-114393 | MEDIO4.3 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close | 21/10/2026 |
| CVE-2026-114392 | MEDIO5.3 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handl | 21/10/2026 |
| CVE-2021-45785 | MEDIO6.5 | TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has sufficien | 24/06/2024 |
| CVE-2023-26982 | MEDIO5.4 | Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function. | 29/03/2023 |
| CVE-2022-1719 | MEDIO5.4 | Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page | 29/09/2022 |
| CVE-2022-1718 | ALTO7.5 | The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service. | 29/09/2022 |
| CVE-2022-2128 | CRÍTICO9.8 | Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4. | 20/06/2022 |
| CVE-2022-2023 | CRÍTICO9.8 | Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. | 20/06/2022 |
| CVE-2022-1947 | MEDIO6.5 | Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3. | 31/05/2022 |
| CVE-2022-1893 | MEDIO5.3 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3. | 31/05/2022 |
| CVE-2022-1808 | ALTO8.8 | Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3. | 31/05/2022 |