RT
Product
Request Tracker
33
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 7Medium 12Low 1
Watch
Add Request Tracker to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44230 | 6.1 | Jul 20 | RT: Reflected Cross-Site Scripting in search results chart Affected: 5.0.4 before 5.0.10; 6.0.0 before 6.0.3 |
| CVE-2026-44227 | 6.1 | Jul 20 | RT: Reflected Cross-Site Scripting via URL parameters Affected: 6.0.0 before 6.0.3 |
| CVE-2026-6841 | 6.1 | May 21 | Reflected XSS in Request Tracker Affected: 5.0.4 before 5.0.10; 6.0.0 before 6.0.3 |
| CVE-2025-31501 | 6.1 | May 28 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink Affected: 4.4.0 before 4.4.8; 5.0.0 before 5.0.8 |
| CVE-2025-30087 | 6.1 | May 28 | Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL Affected: 4.4.0 before 4.4.8; 5.0.0 before 5.0.8 |
| CVE-2025-31500 | 6.1 | May 28 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name Affected: 5.0.0 before 5.0.8 |
| CVE-2022-25803 | 6.1 | Jul 14 | Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search Affected: before 5.0.3 |
| CVE-2022-25802 | 6.1 | Jul 14 | Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment Affected: before 4.4.6; 5.0.0 before 5.0.3 |
| CVE-2016-6127 | 6.1 | Jul 3 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2017-5361 | 5.9 | Jul 3 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2026-44229 | 5.4 | Jul 20 | RT: Cross-Site Scripting via inline-served uploaded content Affected: 5.0.0 before 5.0.10; 6.0.0 before 6.0.3 |
| CVE-2026-44228 | 5.4 | Jul 20 | RT: Stored Cross-Site Scripting via insufficient template escaping Affected: 6.0.0 before 6.0.3 |
Showing 12