[ Vendor · 12 CVEs ]
polonel
CVEs affecting polonel published in the last 30 days, plus any polonel CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114399 | 21 Oct 2026 | CVSS 6.5 | polonel trudeskTrudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal… | |
| CVE-2026-114400 | 21 Oct 2026 | CVSS 5.9 | polonel trudeskTrudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments… | |
| CVE-2026-114401 | 21 Oct 2026 | CVSS 5.3 | polonel trudeskTrudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by… | |
| CVE-2026-114402 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated… | |
| CVE-2026-114394 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by… | |
| CVE-2026-114395 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other… | |
| CVE-2026-114396 | 21 Oct 2026 | CVSS 7.1 | polonel trudeskTrudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where… | |
| CVE-2026-114397 | 21 Oct 2026 | CVSS 7.4 | polonel trudeskTrudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated… | |
| CVE-2026-114398 | 21 Oct 2026 | CVSS 5.4 | polonel trudeskTrudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public… | |
| CVE-2026-114392 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET… | |
| CVE-2026-114393 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via… | |
| CVE-2026-111345 | 15 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying… |