GI
Vendor
GROWI, Inc.
15
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115624 New | GR GROWI GROWI, Inc. | 5.3 | Oct 28 | GROWI contains a missing authorization check vulnerability in its collaborative editing feature |
| CVE-2026-109848 New | GR GROWI GROWI, Inc. | 4.2 | Oct 28 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key |
| CVE-2026-105272 New | GR GROWI GROWI, Inc. | 4.2 | Oct 28 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key |
| CVE-2026-100727 | GR GROWI GROWI, Inc. | 5.3 | Oct 5 | An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file… |
| CVE-2026-53620 | GR GROWI GROWI, Inc. | 6.3 | Aug 31 | GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs |
| CVE-2026-68951 | GR GROWI GROWI, Inc. | 5.3 | Aug 31 | GROWI contains an incorrect authorization vulnerability |
| CVE-2026-80191 | GR GROWI GROWI, Inc. | 7.5 | Aug 25 | GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests |
| CVE-2026-41951 | GR GROWI GROWI, Inc. | 7.2 | May 11 | Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in… |
| CVE-2026-41040 | GR GROWI GROWI, Inc. | 7.5 | Apr 23 | GROWI provided by GROWI, Inc |
| CVE-2026-26291 | GR GROWI GROWI, Inc. | 5.4 | Apr 15 | Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier |
| CVE-2026-25083 | GR GROWI GROWI, Inc. | 8.3 | Mar 16 | GROWI OpenAI thread/message API endpoints do not perform authorization |
| CVE-2025-64700 | GR GROWI GROWI, Inc. | 4.3 | Dec 17 | Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier |
| CVE-2025-61994 | GR GROWI GROWI, Inc. | 5.4 | Nov 6 | Cross-site scripting vulnerability exists in GROWI prior to v7.2.10 |
| CVE-2025-54806 | GR GROWI GROWI, Inc. | 6.1 | Oct 23 | GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function |
| CVE-2025-43880 | GR GROWI GROWI, Inc. | 4.3 | Jun 25 | Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6 |