[ Vendor · 5 CVEs ]
indico
CVEs affecting indico published in the last 30 days, plus any indico CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108388 | 13 Oct 2026 | CVSS 3.5 | indicoIndico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user… | |
| CVE-2026-107397 | 8 Oct 2026 | CVSS 4.4 | Indico: Cross-Site-Scripting in minutes editorIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can… | Fix |
| CVE-2026-107394 | 8 Oct 2026 | CVSS 6.8 | Indico: Incomplete Server-Side Request Forgery (SSRF) checkIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix… | Fix |
| CVE-2026-107395 | 8 Oct 2026 | CVSS 4.3 | Indico: Missing access check in legacy session export APIIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated… | Fix |
| CVE-2026-107396 | 8 Oct 2026 | CVSS 5.4 | Indico: Cross-Site-Scripting in link fieldsIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can… | Fix |