CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 11:50 UTC )
This week: 5,501 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,501 Show in the list Critical, last 7 days 358 Show in the list Healthcare-tagged, last 7 days 5 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product combodo:itop . Show all products
30 CVEs, showing 1 to 30
CVE Severity Title Published CVE-2026-108717 Medium 6.3 Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController Assigned by VulnCheck
Oct 11, 2026 CVE-2026-40877 High 8.7 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences Assigned by GitHub_M
Aug 24, 2026 CVE-2026-30864 High 8.9 Combodo iTop: Reflected XSS in dashboard revert Assigned by GitHub_M
Aug 24, 2026 CVE-2026-39975 Critical 9.4 Combodo iTop: Remote code execution using external auth variable value Assigned by GitHub_M
Aug 24, 2026 CVE-2026-34949 Medium 6.5 Combodo iTop: Unauthenticated user can delete .readonly file Assigned by GitHub_M
Aug 21, 2026 CVE-2026-34948 High 7.7 Combodo iTop: Access control bypass via OQL joins Assigned by GitHub_M
Aug 21, 2026 CVE-2026-34836 Medium 6.5 Combodo iTop: Improper access control in ajax.render.php and ajax.document.php Assigned by GitHub_M
Aug 21, 2026 CVE-2026-34741 High 8.6 Combodo iTop: Authentication bypass in exec.php allows PHP file execution Assigned by GitHub_M
Aug 21, 2026 CVE-2026-33333 Low 3.5 Combodo iTop: Information disclosure in ajax.render.php Assigned by GitHub_M
Aug 21, 2026 CVE-2026-33240 High 8.8 Combodo iTop: Reflected XSS in foreign key search criteria Assigned by GitHub_M
Aug 21, 2026 CVE-2026-33047 Medium 4.3 Combodo iTop: Object can be locked by a user without write permissions Assigned by GitHub_M
Aug 21, 2026 CVE-2026-31936 High 8.8 Combodo iTop: Unauthorized access to object information via search operation Assigned by GitHub_M
Aug 21, 2026 CVE-2026-31880 High 8.0 Combodo iTop: Reflected XSS in universal search Assigned by GitHub_M
Aug 21, 2026 CVE-2026-31803 High 8.0 Combodo iTop: Reflected XSS in tag admin Assigned by GitHub_M
Aug 21, 2026 CVE-2026-30890 High 8.0 Combodo iTop: Reflected XSS in synchro/synchro_import.php Assigned by GitHub_M
Aug 21, 2026 CVE-2026-30865 High 7.1 Combodo iTop: Reflected XSS in dashboard save Assigned by GitHub_M
Aug 21, 2026 CVE-2026-30826 High 8.0 Combodo iTop: Reflected XSS in run_query.php Assigned by GitHub_M
Aug 21, 2026 CVE-2026-30819 High 7.3 Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter Assigned by GitHub_M
Aug 21, 2026 CVE-2026-27490 High 7.5 Combodo iTop: Weak secret generation for inline image Assigned by GitHub_M
Aug 21, 2026 CVE-2026-27463 Medium 5.3 Combodo iTop: Version disclosure via login page logo Assigned by GitHub_M
Aug 21, 2026 CVE-2026-27462 High 7.5 Combodo iTop: User enumeration via password reset Assigned by GitHub_M
Aug 21, 2026 CVE-2026-30866 High 7.5 Combodo iTop: Insecured access to uploaded images via sniffed url Assigned by GitHub_M
Aug 21, 2026 CVE-2025-64167 Medium 6.1 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-49145 Medium 6.5 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-48878 Medium 4.3 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-48065 Medium 6.1 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-48055 Medium 5.4 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-47932 Medium 6.1 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-47773 Medium 6.1 Combodo iTop is a web based IT service management tool. Nov 10, 2025 CVE-2025-47286 High 7.2 Combodo iTop is a web based IT service management tool. Nov 10, 2025
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
