Known vulnerabilities in Leantime

Software: Leantime
Software CPE: cpe:2.3:a:leantime_systems:leantime:*:*:*:*:*:*:*:*
Total vulnerabilities: 26
Public exploits: 4
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Leantime Leantime is affected by 26 known vulnerabilities: 1 high, 12 medium, 13 low Critical High Medium Low

Vulnerabilities (26)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU153274 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
Available
No
3.10.0 05.10.2026 SB2026100542
#VU153273 - Missing Authorization
CWE-862 Medium
No
No
3.10.0 05.10.2026 SB2026100542
#VU153272 - Improper Privilege Management
CWE-269 Medium
No
No
3.10.0 05.10.2026 SB2026100542
#VU153271 - Authorization Bypass Through User-Controlled Key
CWE-639 Medium
Available
No
3.9.0 05.10.2026 SB2026100541
#VU153261 - Authorization Bypass Through User-Controlled Key
CWE-639 Medium
No
No
3.10.0 05.10.2026 SB2026100542
#VU153249 - Authorization Bypass Through User-Controlled Key
CWE-639 Medium
No
No
3.10.0 05.10.2026 SB2026100542
#VU153248 - Authorization Bypass Through User-Controlled Key
CWE-639 Medium
No
No
3.10.0 05.10.2026 SB2026100542
#VU153247 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
3.9.6 05.10.2026 SB2026100540
#VU153246 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
3.8.0 05.10.2026 SB2026100539
#VU138421 - Improper Privilege Management
CWE-269 Medium
Available
No
- 20.07.2026 SB2026072020
#VU104158 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-28254
CWE-79 Low
No
No
3.3.0 24.02.2025 SB2025022418
#VU104157 - Missing Authorization
CWE-862 Medium
No
No
3.3.0 24.02.2025 SB2025022418
#VU104156 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
3.3.0 24.02.2025 SB2025022418
#VU104155 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
Available
No
- 24.02.2025 SB2025022420
#VU104154 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
3.3.0 24.02.2025 SB2025022418
#VU104153 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
3.3.0 24.02.2025 SB2025022418
#VU104148 - Improper input validation
CWE-20 Medium
No
No
3.1.2 24.02.2025 SB2025022419
#VU104147 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
3.1.2 24.02.2025 SB2025022419
#VU104146 - URL Redirection to Untrusted Site ('Open Redirect')
CWE-601 Medium
No
No
3.3.0 24.02.2025 SB2025022418
#VU104145 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
3.3.0 24.02.2025 SB2025022418


Showing elements 1 - 20 out of 26