CO
Product
core
20
CVEs
0
On KEV
9.8
Max CVSS
15
New 30D
Severity mix
Critical 1High 4Medium 15Low 0
Watch
Add core to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-117532 New | 9.8 | Oct 27 | REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin Affected: 5.3.0 before 5.21.4 |
| CVE-2026-117536 New | 8.8 | Oct 27 | REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation Affected: before 5.21.3 |
| CVE-2026-116896 New | 7.5 | Oct 27 | REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables Affected: before 5.21.5 |
| CVE-2026-53599 | 7.5 | Jul 31 | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers Affected: >= 5.18.2, < 5.21.1 |
| CVE-2026-116898 New | 7.1 | Oct 27 | REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move Affected: before 5.21.4 |
| CVE-2026-116893 New | 6.8 | Oct 27 | REDAXO core before 5.21.5 Missing Authorization in rex_api_package API Affected: before 5.21.5 |
| CVE-2026-116899 New | 6.5 | Oct 27 | REDAXO before 5.21.4 Broken Access Control in Slice Operations Affected: before 5.21.4 |
| CVE-2026-116897 New | 6.5 | Oct 27 | REDAXO before 5.21.4 Missing Authorization in Version and History Previews Affected: before 5.21.4 |
| CVE-2026-63000 | 6.4 | Sep 23 | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates Affected: < 5.21.2 |
| CVE-2026-117535 New | 6.1 | Oct 27 | REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool Affected: before 5.21.3 |
| CVE-2026-117534 New | 5.4 | Oct 27 | REDAXO before 5.21.3 CSRF in Article History Plugin Affected: before 5.21.3 |
| CVE-2026-116900 New | 5.4 | Oct 27 | REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets Affected: before 5.21.4 |
| CVE-2026-116895 New | 5.4 | Oct 27 | REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter Affected: before 5.21.5 |
| CVE-2026-63002 | 4.8 | Sep 23 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames Affected: < 5.21.2 |
| CVE-2026-63001 | 4.8 | Sep 23 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` Affected: < 5.21.2 |
| CVE-2026-117533 New | 4.4 | Oct 27 | REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads Affected: 5.18.0 before 5.21.4 |
| CVE-2026-62998 | 4.3 | Sep 23 | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration Affected: < 5.21.2 |
| CVE-2026-116894 New | 4.2 | Oct 27 | REDAXO before 5.21.5 Insufficient Session Expiration on Password Change Affected: before 5.21.5 |
| CVE-2026-117538 New | 4.1 | Oct 27 | REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter Affected: before 5.21.0 |
| CVE-2026-117537 New | 4.1 | Oct 27 | REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter Affected: before 5.21.0 |
Showing 20