Login Request a demo
SA
Product
Savane
by GNU · last CVE Jun 20, 2026
5
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 0High 3Medium 1Low 1
Severity
All severities5Critical0High3Medium1Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Savane to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-27632
8.8
1%
Apr 8
An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function
Affected: before 3.13
CVE-2024-29399
7.6
1%
Apr 11
An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component
Affected: through 3.13
CVE-2024-27630
7.5
1%
Apr 8
Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_data_delete_file…
Affected: before 3.13
CVE-2024-27631
6.0
0%
Apr 8
Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php
Affected: before 3.13
CVE-2026-56355
3.7
0%
Jun 20
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization
Affected: 3.14 through 3.17
Showing 5