[ Vendor · 4 CVEs ]
ProjectSend
CVEs affecting ProjectSend published in the last 30 days, plus any ProjectSend CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112001 | 18 Oct 2026 | CVSS 7.2 | ProjectSendProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's… | |
| CVE-2026-112002 | 18 Oct 2026 | CVSS 6.8 | ProjectSendProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of… | |
| CVE-2026-112003 | 18 Oct 2026 | CVSS 5.9 | ProjectSendProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to… | |
| CVE-2024-11680 | 26 Nov 2024 | CVSS 9.8 | ProjectSend Improper AuthenticationProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw… | ExploitedFix |