21
CVEs
1
Critical
15
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
15
MEDIUM
4
LOW
1
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-39975 | Unauthenticated code execution in Combodo iTop before 3.2.3 arises because remote users can delete the setup-generated .readonly lockfile, which is the guard that blocks write operations and, once removed, re-opens privileged setup/configuration paths that lead to arbitrary code execution (CWE-94). Any internet-reachable iTop instance below 3.2.3 is affected, and the flaw carries a CVSS 4.0 score of 9.4 with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial precondition (a single unauthenticated file-deletion request) makes weaponization realistic. | CRITICAL | 9.4 | 0.3% | 47 |
|
| CVE-2026-30864 | Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated attacker to inject malicious scripts via the dashboard revert functionality, executing arbitrary JavaScript in a victim's browser session within the iTop context. The CVSS 8.9 score and Changed scope (S:C) reflect that successful exploitation extends impact beyond the iTop application itself - enabling session hijacking, credential theft, or privilege escalation on behalf of the victim user. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.9 | 0.2% | 45 |
|
| CVE-2026-33240 | Reflected XSS in Combodo iTop's foreign key search criteria API (all versions prior to 3.2.3) enables remote attackers to execute arbitrary JavaScript in the browser context of authenticated iTop users by delivering a crafted URL. The CVSS 8.8 rating reflects low attack complexity and high impact on confidentiality, integrity, and availability within the ITSM platform's session context. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patch 3.2.3 is available. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-31936 | Missing object-level authorization in Combodo iTop prior to 3.2.3 allows authenticated users to retrieve IT management objects outside their permitted access scope via the search interface. The flaw resides in AjaxRenderController::GetDataForTable(), which returned DBObjectSet results without calling UserRights::IsActionAllowed() - confirmed by the fix commit. No public exploit has been identified at time of analysis, but the low-privilege, network-accessible attack path makes this a credible threat for any multi-tenant or role-segmented iTop deployment. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-40877 | PHP object injection in Combodo iTop's user preference functionality prior to version 3.2.3 enables authenticated remote attackers to achieve remote code execution on the underlying server. The vulnerability stems from deserializing attacker-controlled PHP objects without validation, with the CVSS Scope:Changed metric reflecting that successful exploitation escapes the application boundary to compromise the host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-502 vulnerability class is well-understood and the attack complexity is rated Low once an authenticated session is obtained. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-34741 | Unauthenticated remote PHP file execution in Combodo iTop prior to 3.2.3 allows attackers to invoke arbitrary PHP files from the env-production module directory by sending crafted requests to the exec.php dispatcher, which performed no authentication check before routing to module pages. The flaw is classified as CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N), indicating zero-friction network exploitation with no credentials required. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.6 | 0.4% | 43 |
|
| CVE-2026-30826 | Reflected XSS in Combodo iTop's OQL query testing interface (run_query.php) allows authenticated attackers to inject and execute arbitrary JavaScript in the browser sessions of other authenticated users. All iTop versions prior to 3.2.3 are affected; the vendor has released a patch in 3.2.3 confirmed by a public GitHub advisory and commit. No public exploit code or active exploitation has been identified at time of analysis. | HIGH | 8.0 | 0.2% | 40 |
|
| CVE-2026-31803 | Reflected Cross-Site Scripting in Combodo iTop's tagadmin.php page allows an authenticated attacker to craft a malicious URL that, when visited by another authenticated user, executes arbitrary JavaScript in their browser session. All iTop installations prior to version 3.2.3 are affected, with the vulnerability root-caused to the $sFilter request parameter being reflected into HTML output without sanitization. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS impact scores reflect the realistic potential for session hijacking or privilege escalation within the iTop management interface. | HIGH | 8.0 | 0.2% | 40 |
|
| CVE-2026-30890 | Reflected XSS in Combodo iTop's synchro import script prior to version 3.2.3 enables attackers to inject and execute arbitrary JavaScript in the browsers of authenticated users who click a crafted link. The vulnerable parameter `data_source_id` in `synchro/synchro_import.php` was processed without output encoding, as confirmed by the vendor fix commit. No active exploitation has been identified at time of analysis, and no public exploit code has been disclosed. | HIGH | 8.0 | 0.2% | 40 |
|
| CVE-2026-31880 | Reflected XSS in Combodo iTop's universal search feature (all versions prior to 3.2.3) allows an authenticated attacker to inject arbitrary JavaScript via the OQL filter parameter, which executes in a victim's browser upon visiting a crafted URL. The root cause is direct HTML output of the user-supplied OQL query string in UniversalSearch.php without sanitization, confirmed by the patch commit adding utils::EscapeHtml(). No CISA KEV listing or confirmed public exploit exists at time of analysis; exploitation requires attacker-supplied credentials and victim interaction, limiting opportunistic risk despite the CVSS 8.0 rating. | HIGH | 8.0 | 0.2% | 40 |
|
| CVE-2026-34948 | Access control bypass in Combodo iTop prior to 3.2.3 allows authenticated low-privileged users to read data outside their assigned silos via crafted OQL queries. The iTop silo isolation mechanism - which restricts users to specific data partitions - fails to apply visibility filters to classes joined in OQL but not explicitly listed in the SELECT clause, enabling cross-silo confidential data disclosure. No public exploit code or CISA KEV listing exists at time of analysis; the vendor has released a confirmed fix in version 3.2.3. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-27490 | Unauthenticated access to inline images in Combodo iTop prior to version 3.2.3 is protected by a 24-bit secret generated with PHP's non-cryptographic mt_rand(), yielding only ~16.7 million possible values and making brute-force enumeration feasible for any network-reachable attacker. The commit diff confirms the secret was stored as a 6-character hex string (sprintf('%06x', mt_rand(0, 0xFFFFFF))), and a secondary timing side-channel existed because the comparison used != instead of constant-time hash_equals(). No active exploitation is confirmed in CISA KEV, and no public POC has been identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2026-27462 | User enumeration in Combodo iTop prior to version 3.2.3 allows remote unauthenticated attackers to identify valid accounts by observing distinct error responses in the forgot-password mechanism. The application returned different messages depending on account state - external authentication, fixed password, missing email - making it possible to distinguish valid usernames from invalid ones without any credentials. No public exploit code has been identified at time of analysis, and the issue is resolved in iTop 3.2.3 per the vendor's GitHub Security Advisory GHSA-888g-gv33-xwwx. | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2026-30866 | Unauthenticated remote access to uploaded documents is possible in Combodo iTop versions prior to 3.2.3 due to a missing authentication check in the ajax.document.php endpoint. The commit diff confirms that LoginWebPage::DoLoginEx() was absent from critical code paths that serve uploaded files, allowing any network-reachable user who obtains a valid document URL to download sensitive content without credentials. No public exploit code has been identified at time of analysis, but the attack is technically trivial given the low-complexity, unauthenticated CVSS vector. | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2026-30819 | Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated low-privilege attacker to inject arbitrary JavaScript via the unsanitized `dashboard_id` parameter in the dashboard revert endpoint `/pages/ajax.render.php`. When a crafted URL is opened by a higher-privileged victim, the payload executes in their browser context, enabling session hijacking or unauthorized actions performed under the victim's identity. No CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis. | HIGH | 7.3 | 0.3% | 37 |
|