CO
Product
core
20
CVEs
0
On KEV
9.8
Max CVSS
15
New 30D
Severity mix
Critical 1High 4Medium 15Low 0
Watch
Add core to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116893 New | 6.8 | Oct 27 | REDAXO core before 5.21.5 Missing Authorization in rex_api_package API Affected: before 5.21.5 |
| CVE-2026-116899 New | 6.5 | Oct 27 | REDAXO before 5.21.4 Broken Access Control in Slice Operations Affected: before 5.21.4 |
| CVE-2026-116897 New | 6.5 | Oct 27 | REDAXO before 5.21.4 Missing Authorization in Version and History Previews Affected: before 5.21.4 |
| CVE-2026-63000 | 6.4 | Sep 23 | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates Affected: < 5.21.2 |
| CVE-2026-117535 New | 6.1 | Oct 27 | REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool Affected: before 5.21.3 |
| CVE-2026-117534 New | 5.4 | Oct 27 | REDAXO before 5.21.3 CSRF in Article History Plugin Affected: before 5.21.3 |
| CVE-2026-116900 New | 5.4 | Oct 27 | REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets Affected: before 5.21.4 |
| CVE-2026-116895 New | 5.4 | Oct 27 | REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter Affected: before 5.21.5 |
| CVE-2026-63002 | 4.8 | Sep 23 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames Affected: < 5.21.2 |
| CVE-2026-63001 | 4.8 | Sep 23 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` Affected: < 5.21.2 |
| CVE-2026-117533 New | 4.4 | Oct 27 | REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads Affected: 5.18.0 before 5.21.4 |
| CVE-2026-62998 | 4.3 | Sep 23 | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration Affected: < 5.21.2 |
| CVE-2026-116894 New | 4.2 | Oct 27 | REDAXO before 5.21.5 Insufficient Session Expiration on Password Change Affected: before 5.21.5 |
| CVE-2026-117538 New | 4.1 | Oct 27 | REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter Affected: before 5.21.0 |
| CVE-2026-117537 New | 4.1 | Oct 27 | REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter Affected: before 5.21.0 |
Showing 15