GL
Vendor
glpi-project
233
CVEs
1
On KEV
1
New 30D
Products
GL9.8
glpi
glpi-project
214 CVEs1 on KEV1 new
GI9.8
Glpi Inventory
Glpi-project
4 CVEs0 on KEV0 new
GA7.8
Glpi Agent
Glpi-project
3 CVEs0 on KEV0 new
GL8.8
glpi-inventory-plugin
glpi-project
3 CVEs0 on KEV0 new
AC7.5
Activity
Glpi-project
1 CVEs0 on KEV0 new
BA7.5
Barcode
Glpi-project
1 CVEs0 on KEV0 new
CM6.5
Cmdb
Glpi-project
1 CVEs0 on KEV0 new
DA4.3
Dashboard
Glpi-project
1 CVEs0 on KEV0 new
MA7.5
Manageentities
Glpi-project
1 CVEs0 on KEV0 new
MR6.5
More Reporting
Glpi-project
1 CVEs0 on KEV0 new
OR8.8
Order
Glpi-project
1 CVEs0 on KEV0 new
PO9.8
Positions
Glpi-project
1 CVEs0 on KEV0 new
RE6.1
Reports
Glpi-project
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108726 | GL GLPI glpi-project | 4.3 | Oct 11 | GLPI through 12.0.0 Missing Authorization via ajax/map.php |
| CVE-2026-53629 | GL glpi glpi-project | 7.1 | Sep 25 | GLPI: SQL injection in history tab |
| CVE-2026-53626 | GL glpi glpi-project | 7.1 | Sep 25 | GLPI: Arbitrary Document Read via Form Context Authorization Bypass |
| CVE-2026-48482 | GL glpi glpi-project | 9.4 | Sep 25 | GLPI: RCE via Form import |
| CVE-2026-53625 | GL glpi glpi-project | 7.5 | Sep 25 | GLPI: Privilege Escalation via authtype API manipulation |
| CVE-2026-53610 | GL glpi glpi-project | 7.5 | Sep 25 | GLPI: Reflected XSS in dashboards |
| CVE-2026-47679 | GL glpi glpi-project | 8.5 | Sep 25 | GLPI: arbitrary file deletion |
| CVE-2026-55214 | GL glpi glpi-project | 8.5 | Sep 25 | GLPI: Stored XSS in suppliers |
| CVE-2026-49470 | GL glpi glpi-project | 7.7 | Sep 25 | GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force |
| CVE-2026-55217 | GL glpi glpi-project | 5.3 | Sep 25 | GLPI: Unallowed modfication of knowbase items comments and translations |
| CVE-2026-53628 | GL glpi glpi-project | 5.9 | Sep 25 | GLPI: Unallowed authentication method update by administrator |
| CVE-2026-45801 | GL glpi glpi-project | 5.3 | Sep 25 | GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) |
| CVE-2026-53627 | GL glpi glpi-project | 6.0 | Sep 25 | GLPI: Unexpected access to update operations through the API |
| CVE-2026-49469 | GL glpi glpi-project | 4.6 | Sep 25 | GLPI: LDAP filter injection in user import feature |
| CVE-2026-13490 | GL glpi glpi-project | 3.7 | Jun 28 | glpi-project glpi Document document.send.php canViewFile authorization |
| CVE-2026-42321 | GL glpi glpi-project | 8.4 | Jun 3 | GLPI has stored XSS in asset locks |
| CVE-2026-42320 | GL glpi glpi-project | 5.9 | Jun 3 | GLPI vulnerable to arbitrary file access |
| CVE-2026-42318 | GL glpi glpi-project | 7.0 | Jun 3 | GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint |
| CVE-2026-42317 | GL glpi glpi-project | 7.0 | Jun 3 | GLPI vulnerable to arbitrary files deletion by technician |
| CVE-2026-44281 | GL glpi glpi-project | 7.0 | Jun 3 | GLPI vulnerable to unauthorized reading of a specific asset object |
| CVE-2026-40108 | GL glpi glpi-project | 7.1 | Jun 2 | GLPI Vulnerable to Stored XSS in ITIL Costs |
| CVE-2026-5385 | GL glpi glpi-project | 8.4 | Jun 2 | GLPI 11.0.0 - Stored XSS in knowledge base |
| CVE-2026-32312 | GL glpi glpi-project | 4.3 | May 18 | GLPI: Unauthorized export of form structure |
| CVE-2026-29047 | GL glpi glpi-project | 8.8 | Apr 6 | GLPI has an Authenticated SQL Injection via log exports |
| CVE-2026-26263 | GL glpi glpi-project | 9.8 | Apr 6 | GLPI has an Unauthenticated SQL Injection via Search engine |
| CVE-2026-26027 | GL glpi glpi-project | 6.1 | Apr 6 | GLPI has an Unauthenticated Stored XSS via inventory |
| CVE-2026-26026 | GL glpi glpi-project | 7.2 | Apr 6 | GLPI has a Server-Side Template Injection via Double-Compilation |
| CVE-2026-25932 | GL glpi glpi-project | 4.8 | Apr 6 | GLPI has Stored XSS in Supplier 'Website' field |
| CVE-2026-26001 | GL glpi-inventory-plugin glpi-project | 8.8 | Mar 17 | GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report |
| CVE-2026-25937 | GL glpi glpi-project | 6.5 | Mar 17 | GLPI has a MFA bypass |
| CVE-2026-25936 | GL glpi glpi-project | 8.8 | Mar 17 | GLPI Vulnerable to Authenticated SQL Injection |
| CVE-2026-22248 | GL glpi glpi-project | 8.8 | Mar 11 | GLPI affected by Remote Code Execution via malicious upload |
| CVE-2026-25590 | GL glpi-inventory-plugin glpi-project | 6.1 | Mar 3 | GLPI Inventory Plugin has Reflected XSS in task jobs |
| CVE-2026-22821 | MR More Reporting Glpi-project | 6.5 | Feb 12 | mreporting affected by a SQLI on date change |
| CVE-2026-22044 | GL glpi glpi-project | 8.8 | Feb 4 | GLPI is Vulnerable to Authenticated SQL Injection |
| CVE-2026-23624 | GL glpi glpi-project | 6.5 | Feb 4 | GLPI is vulnerable to session stealing on externally authenticated user change |
| CVE-2026-22247 | GL glpi glpi-project | 9.1 | Feb 4 | GLPI is Vulnerable to SSRF via Webhooks |
| CVE-2025-66417 | GL glpi glpi-project | 9.8 | Jan 15 | GLPI has an unauthenticated SQL injection through the inventory endpoint |
| CVE-2025-64516 | GL glpi glpi-project | 7.5 | Jan 15 | GLPI incorrectly authorizes access to documents |
| CVE-2023-53943 | GL GLPI Glpi-Project | 5.3 | Dec 18 | GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint |
| CVE-2025-64520 | GL glpi glpi-project | 4.3 | Dec 16 | GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API |
| CVE-2025-59935 | GL glpi glpi-project | 6.5 | Dec 16 | GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page |
| CVE-2025-32786 | GL glpi-inventory-plugin glpi-project | 7.5 | Nov 4 | GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection |
| CVE-2025-53105 | GL glpi glpi-project | 7.5 | Aug 27 | GLPI permits unauthorized rules execution order |
| CVE-2025-53357 | GL glpi glpi-project | 5.4 | Jul 30 | GLPI permits reservation modification by unauthorized users |
| CVE-2025-53113 | GL glpi glpi-project | 2.7 | Jul 30 | GLPI technicians can access unauthorized information through external links |
| CVE-2025-53112 | GL glpi glpi-project | 4.3 | Jul 30 | GLPI's incomprehensive permission checks can lead to data removal from allowed users |
| CVE-2025-53111 | GL glpi glpi-project | 6.5 | Jul 30 | GLPI exposes data to non-allowed users |
| CVE-2025-53008 | GL glpi glpi-project | 6.5 | Jul 30 | GLPI's MailCollector Receiver is vulnerable to credential exfiltration |
| CVE-2025-52897 | GL glpi glpi-project | 6.1 | Jul 30 | GLPI is vulnerable to XSS and open redirection attacks through planning feature |
| CVE-2025-52567 | GL glpi glpi-project | 5.0 | Jul 30 | GLPI has overly permissive URL verification |
| CVE-2025-27514 | GL glpi glpi-project | 5.4 | Jul 29 | GLPI is susceptible to Stored XSS attack through project's kanban |
| CVE-2025-27147 | GL glpi-inventory-plugin glpi-project | 8.2 | Mar 25 | GLPI Inventory plugin has Improper Access Control Vulnerability |
| CVE-2025-24801 | GL Glpi Glpi-project | 8.8 | Mar 18 | GLPI is a free asset and IT management software package |
| CVE-2025-24799 | GL Glpi Glpi-project | 9.8 | Mar 18 | GLPI is a free asset and IT management software package |
| CVE-2025-21619 | GL Glpi Glpi-project | 9.8 | Mar 18 | GLPI is a free asset and IT management software package |
| CVE-2025-25192 | GL Glpi Glpi-project | 6.5 | Feb 25 | GLPI is a free asset and IT management software package |
| CVE-2025-23046 | GL Glpi Glpi-project | 7.5 | Feb 25 | GLPI is a free asset and IT management software package |
| CVE-2025-23024 | GL Glpi Glpi-project | 4.3 | Feb 25 | GLPI is a free asset and IT management software package |
| CVE-2025-21627 | GL Glpi Glpi-project | 6.1 | Feb 25 | GLPI is a free asset and IT management software package |