Login Request a demo
RT
Product
rt
by bestpractical · last CVE Jul 20, 2026
48
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Vulnerabilities48In the news0Timeline
Severity mix
Critical 1High 3Medium 8Low 0
Severity
All severities48Critical1High3Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add rt to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-44230
6.1
0%
Jul 20
RT: Reflected Cross-Site Scripting in search results chart
Affected: >= 5.0.4, < 5.0.10; >= 6.0.0, < 6.0.3
CVE-2026-44227
6.1
0%
Jul 20
RT: Reflected Cross-Site Scripting via URL parameters
Affected: >= 6.0.0, < 6.0.3
CVE-2025-30087
6.1
0%
May 28
Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL
Affected: 4.4.0 before 4.4.8; 5.0.0 before 5.0.8
CVE-2025-31501
6.1
0%
May 28
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink
Affected: 5.0.0 before 5.0.8
CVE-2025-31500
6.1
0%
May 28
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name
Affected: 5.0.0 before 5.0.8
CVE-2026-44229
5.4
0%
Jul 20
RT: Cross-Site Scripting via inline-served uploaded content
Affected: >= 6.0.0, < 6.0.3; >= 5.0.0, < 5.0.10
CVE-2026-44228
5.4
0%
Jul 20
RT: Stored Cross-Site Scripting via insufficient template escaping
Affected: >= 6.0.0, < 6.0.3
CVE-2026-41073
4.6
0%
May 22
RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps
Affected: < 5.0.10; >= 6.0.0, < 6.0.3
Showing 8