CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 13:10 UTC )
This week: 5,478 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,478 Show in the list Critical, last 7 days 360 Show in the list Healthcare-tagged, last 7 days 5 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product combodo:itop . Show all products
30 CVEs, showing 1 to 30
CVE Severity Title Published CVE-2025-47286 High 7.2 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-47773 Medium 6.1 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-47932 Medium 6.1 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-48055 Medium 5.4 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-48065 Medium 6.1 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-48878 Medium 4.3 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-49145 Medium 6.5 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-64167 Medium 6.1 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2026-30866 High 7.5 Combodo iTop: Insecured access to uploaded images via sniffed url Assigned by GitHub_M
Aug 21, 2026 CVE-2026-27462 High 7.5 Combodo iTop: User enumeration via password reset Assigned by GitHub_M
Aug 21, 2026 CVE-2026-27463 Medium 5.3 Combodo iTop: Version disclosure via login page logo Assigned by GitHub_M
Aug 21, 2026 CVE-2026-27490 High 7.5 Combodo iTop: Weak secret generation for inline image Assigned by GitHub_M
Aug 21, 2026 CVE-2026-30819 High 7.3 Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter Assigned by GitHub_M
Aug 21, 2026 CVE-2026-30826 High 8.0 Combodo iTop: Reflected XSS in run_query.php Assigned by GitHub_M
Aug 21, 2026 CVE-2026-30865 High 7.1 Combodo iTop: Reflected XSS in dashboard save Assigned by GitHub_M
Aug 21, 2026 CVE-2026-30890 High 8.0 Combodo iTop: Reflected XSS in synchro/synchro_import.php Assigned by GitHub_M
Aug 21, 2026 CVE-2026-31803 High 8.0 Combodo iTop: Reflected XSS in tag admin Assigned by GitHub_M
Aug 21, 2026 CVE-2026-31880 High 8.0 Combodo iTop: Reflected XSS in universal search Assigned by GitHub_M
Aug 21, 2026 CVE-2026-31936 High 8.8 Combodo iTop: Unauthorized access to object information via search operation Assigned by GitHub_M
Aug 21, 2026 CVE-2026-33047 Medium 4.3 Combodo iTop: Object can be locked by a user without write permissions Assigned by GitHub_M
Aug 21, 2026 CVE-2026-33240 High 8.8 Combodo iTop: Reflected XSS in foreign key search criteria Assigned by GitHub_M
Aug 21, 2026 CVE-2026-33333 Low 3.5 Combodo iTop: Information disclosure in ajax.render.php Assigned by GitHub_M
Aug 21, 2026 CVE-2026-34741 High 8.6 Combodo iTop: Authentication bypass in exec.php allows PHP file execution Assigned by GitHub_M
Aug 21, 2026 CVE-2026-34836 Medium 6.5 Combodo iTop: Improper access control in ajax.render.php and ajax.document.php Assigned by GitHub_M
Aug 21, 2026 CVE-2026-34948 High 7.7 Combodo iTop: Access control bypass via OQL joins Assigned by GitHub_M
Aug 21, 2026 CVE-2026-34949 Medium 6.5 Combodo iTop: Unauthenticated user can delete .readonly file Assigned by GitHub_M
Aug 21, 2026 CVE-2026-39975 Critical 9.4 Combodo iTop: Remote code execution using external auth variable value Assigned by GitHub_M
Aug 24, 2026 CVE-2026-30864 High 8.9 Combodo iTop: Reflected XSS in dashboard revert Assigned by GitHub_M
Aug 24, 2026 CVE-2026-40877 High 8.7 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences Assigned by GitHub_M
Aug 24, 2026 CVE-2026-108717 Medium 6.3 Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController Assigned by VulnCheck
Oct 11, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
