[ Vendor · 21 CVEs ]
Omnispace
CVEs affecting Omnispace published in the last 30 days, plus any Omnispace CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-63171 | 13 Oct 2026 | CVSS 5.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious… | |
| CVE-2026-63156 | 13 Oct 2026 | CVSS 6.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject… | |
| CVE-2026-63157 | 13 Oct 2026 | CVSS 5.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious… | |
| CVE-2026-63168 | 13 Oct 2026 | CVSS 5.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist… | |
| CVE-2026-63169 | 13 Oct 2026 | CVSS 6.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages… | |
| CVE-2026-63172 | 13 Oct 2026 | CVSS 7.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user… | |
| CVE-2026-63174 | 13 Oct 2026 | CVSS 8.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces… | |
| CVE-2026-63154 | 13 Oct 2026 | CVSS 8.8 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by… | |
| CVE-2026-63158 | 13 Oct 2026 | CVSS 7.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt… | |
| CVE-2026-63159 | 13 Oct 2026 | CVSS 7.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over… | |
| CVE-2026-63160 | 13 Oct 2026 | CVSS 7.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the… | |
| CVE-2026-63161 | 13 Oct 2026 | CVSS 8.8 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by… | |
| CVE-2026-63162 | 13 Oct 2026 | CVSS 8.8 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended… | |
| CVE-2026-63163 | 13 Oct 2026 | CVSS 7.5 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated… | |
| CVE-2026-63165 | 13 Oct 2026 | CVSS 8.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious… | |
| CVE-2026-63146 | 13 Oct 2026 | CVSS 9.8 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the… | |
| CVE-2026-63147 | 13 Oct 2026 | CVSS 5.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious… | |
| CVE-2026-63148 | 13 Oct 2026 | CVSS 5.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script… | |
| CVE-2026-63149 | 13 Oct 2026 | CVSS 7.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account… | |
| CVE-2026-63152 | 13 Oct 2026 | CVSS 8.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious… | |
| CVE-2026-63153 | 13 Oct 2026 | CVSS 8.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to… |