maxtime vulnerabilities and fixes

Recent CVEs affecting maxtime, with upgrade or downgrade steps. 43 tracked.

maxtime has 43 tracked vulnerabilities, 9 critical. A fixed release or vendor patch exists for 43. Most recent: 2025-02-12. Highest priority: CVE-2025-26347 (score 56/100).

• CVE-2025-26378 HIGH 8.8 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to versi
• CVE-2025-26377 HIGH 8.1 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to versi
• CVE-2025-26376 MEDIUM 6.5 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to versi
• CVE-2025-26375 HIGH 8.8 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to versi
• CVE-2025-26374 MEDIUM 6.5 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than
• CVE-2025-26373 MEDIUM 6.5 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than o
• CVE-2025-26372 HIGH 7.1 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to
• CVE-2025-26371 HIGH 8.8 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to
• CVE-2025-26370 HIGH 7.1 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to
• CVE-2025-26369 HIGH 8.8 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to
• CVE-2025-26368 HIGH 8.1 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to
• CVE-2025-26367 MEDIUM 4.3 UPGRADE A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to
• CVE-2025-26366 HIGH 7.5 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less
• CVE-2025-26365 HIGH 7.5 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less
• CVE-2025-26364 HIGH 7.5 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less
• CVE-2025-26363 HIGH 7.5 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less
• CVE-2025-26362 HIGH 7.5 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less
• CVE-2025-26361 CRITICAL 9.1 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less
• CVE-2025-26360 MEDIUM 5.3 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTim
• CVE-2025-26359 CRITICAL 9.8 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime l
• CVE-2025-26358 MEDIUM 5.5 UPGRADE A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equa
• CVE-2025-26357 MEDIUM 4.9 UPGRADE A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version
• CVE-2025-26356 HIGH 7.2 UPGRADE A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less tha
• CVE-2025-26355 MEDIUM 6.5 UPGRADE A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version
• CVE-2025-26354 HIGH 7.2 UPGRADE A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or
• CVE-2025-26353 MEDIUM 4.9 UPGRADE A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 al
• CVE-2025-26352 MEDIUM 6.5 UPGRADE A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2
• CVE-2025-26351 MEDIUM 4.9 UPGRADE A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2
• CVE-2025-26350 MEDIUM 4.9 UPGRADE A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime les
• CVE-2025-26349 HIGH 7.2 UPGRADE A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to versio
• CVE-2025-26348 MEDIUM 5.5 UPGRADE A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/
• CVE-2025-26347 CRITICAL 9.8 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less
• CVE-2025-26346 MEDIUM 5.5 UPGRADE A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/
• CVE-2025-26345 CRITICAL 9.8 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less
• CVE-2025-26344 CRITICAL 9.8 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime
• CVE-2025-26343 HIGH 8.1 UPGRADE A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to v
• CVE-2025-26342 CRITICAL 9.8 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime l
• CVE-2025-26341 CRITICAL 9.8 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime l
• CVE-2025-26340 HIGH 8.8 UPGRADE A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to ver
• CVE-2025-26339 CRITICAL 9.8 UPGRADE A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less tha
• CVE-2025-1102 MEDIUM 5.5 UPGRADE A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version
• CVE-2025-1101 MEDIUM 5.3 UPGRADE A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version
• CVE-2025-1100 CRITICAL 9.8 UPGRADE A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.

FAQ

How do I fix maxtime vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is maxtime being exploited right now?

None of the tracked maxtime CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which maxtime CVE should I patch first?

CVE-2025-26347 currently ranks highest (56/100): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less .

RSS feed for maxtime · ← Back to latest CVEs