Known vulnerabilities in kimai2 - page 2

Software: kimai2
Software CPE: cpe:2.3:a:kevin_papst:kimai2:*:*:*:*:*:*:*:*
Total vulnerabilities: 38
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting kimai2 kimai2 is affected by 38 known vulnerabilities: 2 high, 6 medium, 30 low Critical High Medium Low

Vulnerabilities (38)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU135840 - Weak password recovery mechanism
CVE-2026-80196
CWE-640 High
No
No
2.58.0 29.06.2026 SB2026060457
#VU133357 - Server-Side Request Forgery (SSRF)
CVE-2026-49865
CWE-918 Medium
No
No
2.58.0 04.06.2026 SB2026060457
#VU133356 - Cross-Site Request Forgery (CSRF)
CVE-2026-49992
CWE-352 Low
No
No
2.58.0 04.06.2026 SB2026060457
#VU130246 - Exposure of sensitive information to an unauthorized actor
CVE-2026-44298
CWE-200 Low
No
No
2.56.0 06.05.2026 SB2026050636
#VU128254 - Incorrect Authorization
CVE-2026-80202
CWE-863 Medium
Available
No
2.56.0 28.04.2026 SB2026042814
#VU128253 - Protection Mechanism Failure
CVE-2026-80198
CWE-693 Medium
No
No
2.56.0 28.04.2026 SB2026042814
#VU128005 - Improper Neutralization of Formula Elements in a CSV File
CVE-2026-42267
CWE-1236 Medium
No
No
2.54.0 27.04.2026 SB2026042742
#VU126711 - Missing Authorization
CVE-2026-41498
CWE-862 Low
No
No
2.54.0 21.04.2026 SB20260420105
#VU126577 - Information Exposure Through Timing Discrepancy
CVE-2026-80199
CWE-208 Low
No
No
2.54.0 20.04.2026 SB20260420105
#VU125973 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2026-40486
CWE-915 Low
No
No
2.53.0 14.04.2026 SB2026041478
#VU125972 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-40479
CWE-79 Low
No
No
2.53.0 14.04.2026 SB2026041478
#VU125949 - Improper Access Control
CVE-2026-80201
CWE-284 Low
No
No
2.53.0 14.04.2026 SB2026041478
#VU125948 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-80200
CWE-601 Low
No
No
2.53.0 14.04.2026 SB2026041478
#VU125947 - Authorization Bypass Through User-Controlled Key
CVE-2026-28685
CWE-639 Low
No
No
2.51.0 14.04.2026 SB2026041477
#VU121645 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-23626
CWE-1336 Low
Available
No
2.46.0 19.01.2026 SB2026011954
#VU125950 - Insufficient Granularity of Access Control
CVE-2024-29200
CWE-1220 Low
No
No
2.13.0 27.03.2024 SB2024032755
#VU125946 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2023-46245
CWE-1336 Low
No
No
2.1.0 27.10.2023 SB2023102736
#VU58290 - Cross-Site Request Forgery (CSRF)
CVE-2021-3963
CWE-352 Low
No
No
1.16.2 22.11.2021 SB2021112209


Showing elements 21 - 40 out of 38