https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-24007.htmlhttps://patchthecve.com/cve/CVE-2026-24007.htmlWed, 17 Jun 2026 10:22:28 +0000MEDIUM 4.6: Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This https://patchthecve.com/cve/CVE-2025-65962.htmlhttps://patchthecve.com/cve/CVE-2025-65962.htmlWed, 07 Oct 2026 20:10:01 +0000MEDIUM 4.6: Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763803709 and Tuleap Enterprise Edition versions prior to 17.0-4 and 16.13-9 are mission CSRF protections in its tracker field dependencies, allowinhttps://patchthecve.com/cve/CVE-2025-64760.htmlhttps://patchthecve.com/cve/CVE-2025-64760.htmlWed, 07 Oct 2026 20:10:01 +0000MEDIUM 4.6: Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove tracker https://patchthecve.com/cve/CVE-2025-64499.htmlhttps://patchthecve.com/cve/CVE-2025-64499.htmlWed, 07 Oct 2026 20:10:01 +0000MEDIUM 4.6: Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Ahttps://patchthecve.com/cve/CVE-2025-64498.htmlhttps://patchthecve.com/cve/CVE-2025-64498.htmlWed, 07 Oct 2026 20:10:01 +0000MEDIUM 4.6: Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. Thishttps://patchthecve.com/cve/CVE-2025-64497.htmlhttps://patchthecve.com/cve/CVE-2025-64497.htmlWed, 07 Oct 2026 20:10:01 +0000MEDIUM 6.5: Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not hhttps://patchthecve.com/cve/CVE-2025-54877.htmlhttps://patchthecve.com/cve/CVE-2025-54877.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.3: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versions before 16.10.99.1754050155 and Tuleap Enterprise Edition versions before 16.9-8 and before 16.10-5, an attacker can access to the content of the special andhttps://patchthecve.com/cve/CVE-2025-53902.htmlhttps://patchthecve.com/cve/CVE-2025-53902.htmlWed, 17 Jun 2026 09:39:06 +0000MEDIUM 4.3: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5, users may potentially access confidential information from artifacts thhttps://patchthecve.com/cve/CVE-2025-53541.htmlhttps://patchthecve.com/cve/CVE-2025-53541.htmlWed, 17 Jun 2026 09:38:24 +0000MEDIUM 5.4: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1751892857 and Tuleap Enterprise Edition prior to 16.8-5 and 16.9-3, malicious users with some control over certain artifacts could insert mhttps://patchthecve.com/cve/CVE-2025-52899.htmlhttps://patchthecve.com/cve/CVE-2025-52899.htmlWed, 17 Jun 2026 09:37:14 +0000MEDIUM 5.3: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1750843170 and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2, the forgot password form allows for user enumeration. This is fixed in https://patchthecve.com/cve/CVE-2025-50179.htmlhttps://patchthecve.com/cve/CVE-2025-50179.htmlWed, 17 Jun 2026 09:34:48 +0000MEDIUM 4.6: Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims inthttps://patchthecve.com/cve/CVE-2025-48991.htmlhttps://patchthecve.com/cve/CVE-2025-48991.htmlWed, 17 Jun 2026 09:30:37 +0000MEDIUM 4.6: Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into changhttps://patchthecve.com/cve/CVE-2025-30209.htmlhttps://patchthecve.com/cve/CVE-2025-30209.htmlWed, 17 Jun 2026 09:08:21 +0000MEDIUM 5.3: Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information via the FRS REST endpoints it should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742812323 and Tuleap https://patchthecve.com/cve/CVE-2025-30203.htmlhttps://patchthecve.com/cve/CVE-2025-30203.htmlWed, 17 Jun 2026 09:08:20 +0000MEDIUM 4.8: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force victihttps://patchthecve.com/cve/CVE-2025-30155.htmlhttps://patchthecve.com/cve/CVE-2025-30155.htmlWed, 17 Jun 2026 09:08:15 +0000MEDIUM 4.3: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in the REST API. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742392651 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.https://patchthecve.com/cve/CVE-2025-29929.htmlhttps://patchthecve.com/cve/CVE-2025-29929.htmlWed, 17 Jun 2026 09:05:53 +0000MEDIUM 4.6: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This vulnerabihttps://patchthecve.com/cve/CVE-2025-29766.htmlhttps://patchthecve.com/cve/CVE-2025-29766.htmlWed, 17 Jun 2026 09:05:38 +0000MEDIUM 4.6: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comhttps://patchthecve.com/cve/CVE-2025-27402.htmlhttps://patchthecve.com/cve/CVE-2025-27402.htmlWed, 17 Jun 2026 09:03:31 +0000MEDIUM 4.6: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fhttps://patchthecve.com/cve/CVE-2025-27401.htmlhttps://patchthecve.com/cve/CVE-2025-27401.htmlWed, 17 Jun 2026 09:03:31 +0000MEDIUM 4.6: Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filtehttps://patchthecve.com/cve/CVE-2025-27156.htmlhttps://patchthecve.com/cve/CVE-2025-27156.htmlWed, 17 Jun 2026 09:03:07 +0000MEDIUM 4.1: Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail clhttps://patchthecve.com/cve/CVE-2025-27150.htmlhttps://patchthecve.com/cve/CVE-2025-27150.htmlWed, 17 Jun 2026 09:03:06 +0000MEDIUM 5.3: Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to thttps://patchthecve.com/cve/CVE-2025-27099.htmlhttps://patchthecve.com/cve/CVE-2025-27099.htmlWed, 17 Jun 2026 09:03:01 +0000MEDIUM 4.8: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this vulhttps://patchthecve.com/cve/CVE-2025-27094.htmlhttps://patchthecve.com/cve/CVE-2025-27094.htmlWed, 17 Jun 2026 09:03:01 +0000MEDIUM 5.4: Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute forhttps://patchthecve.com/cve/CVE-2025-24029.htmlhttps://patchthecve.com/cve/CVE-2025-24029.htmlWed, 17 Jun 2026 08:57:55 +0000MEDIUM 5.3: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.https://patchthecve.com/cve/CVE-2025-22129.htmlhttps://patchthecve.com/cve/CVE-2025-22129.htmlWed, 17 Jun 2026 08:45:12 +0000MEDIUM 4.3: Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to restricted information. This issue has been addressed in Tuleap Community Edition 16.3.99.1736242932, Tuleap Enterprise Edition 16.2-5, and Thttps://patchthecve.com/cve/CVE-2024-52599.htmlhttps://patchthecve.com/cve/CVE-2024-52599.htmlWed, 17 Jun 2026 08:07:31 +0000MEDIUM 5.4: Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Ganthttps://patchthecve.com/cve/CVE-2024-47767.htmlhttps://patchthecve.com/cve/CVE-2024-47767.htmlWed, 17 Jun 2026 07:57:43 +0000MEDIUM 4.3: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.113, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, users might see tracker names they should not have access to. Tuleap Community Edition 15.13.https://patchthecve.com/cve/CVE-2024-47766.htmlhttps://patchthecve.com/cve/CVE-2024-47766.htmlWed, 17 Jun 2026 07:57:42 +0000MEDIUM 4.9: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictions https://patchthecve.com/cve/CVE-2024-46988.htmlhttps://patchthecve.com/cve/CVE-2024-46988.htmlWed, 17 Jun 2026 07:56:19 +0000MEDIUM 4.8: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, users might receive email notification with information they should not have access to. Tuleaphttps://patchthecve.com/cve/CVE-2024-46980.htmlhttps://patchthecve.com/cve/CVE-2024-46980.htmlWed, 17 Jun 2026 07:56:18 +0000MEDIUM 4.8: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, a site administrator could create an artifact link type with a forward label allowing them to https://patchthecve.com/cve/CVE-2024-39902.htmlhttps://patchthecve.com/cve/CVE-2024-39902.htmlWed, 17 Jun 2026 07:42:59 +0000MEDIUM 4.8: Tuleap is an open source suite to improve management of software developments and collaboration. Prior to Tuleap Community Edition 15.10.99.128 and Tuleap Enterprise Edition 15.10-6 and 15.9-8, the checkbox "Apply same permissions to all sub-items of this folder" in the document manager permissions https://patchthecve.com/cve/CVE-2024-37167.htmlhttps://patchthecve.com/cve/CVE-2024-37167.htmlWed, 17 Jun 2026 07:37:52 +0000MEDIUM 4.3: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see. This issue has been patched in Tuleap Community Edition version 15.9.99.97.https://patchthecve.com/cve/CVE-2024-30246.htmlhttps://patchthecve.com/cve/CVE-2024-30246.htmlWed, 17 Jun 2026 07:26:35 +0000HIGH 7.6: Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which informationhttps://patchthecve.com/cve/CVE-2024-25130.htmlhttps://patchthecve.com/cve/CVE-2024-25130.htmlWed, 17 Jun 2026 07:15:33 +0000MEDIUM 5.4: Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is used mhttps://patchthecve.com/cve/CVE-2024-23344.htmlhttps://patchthecve.com/cve/CVE-2024-23344.htmlWed, 17 Jun 2026 07:12:38 +0000MEDIUM 5.3: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a process validates the permissions of multiple users (e.g. mail notifications). This issue has been patched in version 15.4.99.140 of Tuleap Co