PatchTheCVEinvoiceninja vulnerabilities
Recent CVEs affecting invoiceninja products. 3 tracked.
invoiceninja has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-03-30. Highest priority: CVE-2026-29925 (score 38/100).
- CVE-2026-33742 MEDIUM 5.4 UPGRADE Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel
- CVE-2026-33628 MEDIUM 5.4 UPGRADE Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel
- CVE-2026-29925 HIGH 7.7 DOWNGRADE Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseReques
FAQ
How do I fix invoiceninja vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is invoiceninja being exploited right now?
None of the tracked invoiceninja CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which invoiceninja CVE should I patch first?
CVE-2026-29925 currently ranks highest (38/100): Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseReques.