# Enalean tuleap. Every CVE that names Enalean tuleap among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Tuleap is missing CSRF protection in the Overview inconsistent items](https://agentprime.io/advisories/CVE-2026-24007.md) `CVE-2026-24007` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: Cross-site request forgery (CSRF) - [Tuleap has missing CSRF protections its in tracker field dependencies](https://agentprime.io/advisories/CVE-2025-65962.md) `CVE-2025-65962` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap has missing CSRF protections in its tracker trigger management system](https://agentprime.io/advisories/CVE-2025-64760.md) `CVE-2025-64760` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap is missing CSRF protections for its planning management API](https://agentprime.io/advisories/CVE-2025-64499.md) `CVE-2025-64499` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-64498.md) `CVE-2025-64498` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap exposes releases for all projects to File Release System project administrators](https://agentprime.io/advisories/CVE-2025-64497.md) `CVE-2025-64497` · CVE record: Enalean tuleap · CVSS 6.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Broken access control - [Tuleap missing CSRF protections in the File Release System](https://agentprime.io/advisories/CVE-2025-64482.md) `CVE-2025-64482` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags](https://agentprime.io/advisories/CVE-2025-64117.md) `CVE-2025-64117` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap backlog item representations do not verify the permissions of the child trackers](https://agentprime.io/advisories/CVE-2025-59040.md) `CVE-2025-59040` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2025 · Tags: CWE-280 - [Tuleap's special and always there fields permissions are not verified in cross-tracker search](https://agentprime.io/advisories/CVE-2025-54877.md) `CVE-2025-54877` · CVE record: Enalean tuleap · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Broken access control - [Tuleap exposes artifacts to a mentioned user via email notifications](https://agentprime.io/advisories/CVE-2025-53902.md) `CVE-2025-53902` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: Broken access control - [Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifact](https://agentprime.io/advisories/CVE-2025-53541.md) `CVE-2025-53541` · CVE record: Enalean tuleap · CVSS 5.4 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: Cross-site scripting (XSS) - [Tuleap vulnerable to user enumeration via the lost password form](https://agentprime.io/advisories/CVE-2025-52899.md) `CVE-2025-52899` · CVE record: Enalean tuleap · CVSS 5.3 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: CWE-204 - [Tuleap missing CSRF protection on tracker reports manipulation](https://agentprime.io/advisories/CVE-2025-50179.md) `CVE-2025-50179` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap missing CSRF protection on tracker canned responses administration](https://agentprime.io/advisories/CVE-2025-48991.md) `CVE-2025-48991` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap does not enforce read permissions on parent trackers in the REST API](https://agentprime.io/advisories/CVE-2025-30155.md) `CVE-2025-30155` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Broken access control - [Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin](https://agentprime.io/advisories/CVE-2025-30209.md) `CVE-2025-30209` · CVE record: Enalean tuleap · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Broken access control - [Tuleap allows XSS via the content of RSS feeds in the RSS widgets](https://agentprime.io/advisories/CVE-2025-30203.md) `CVE-2025-30203` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Cross-site scripting (XSS), CWE-84 - [Tuleap is missing CSRF protection on tracker hierarchy administration](https://agentprime.io/advisories/CVE-2025-29929.md) `CVE-2025-29929` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap has missing CSRF protections on artifact submission & edition from the tracker view](https://agentprime.io/advisories/CVE-2025-29766.md) `CVE-2025-29766` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Cross-site request forgery (CSRF) - [Tuleap is missing CSRF protections on tracker fields administrative operations](https://agentprime.io/advisories/CVE-2025-27402.md) `CVE-2025-27402` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: Cross-site request forgery (CSRF) - [In Tuleap, deleting a report can delete criteria filters in other reports](https://agentprime.io/advisories/CVE-2025-27401.md) `CVE-2025-27401` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-440 - [Tuleap allows content injection via emails sent by the mass emailing features](https://agentprime.io/advisories/CVE-2025-27156.md) `CVE-2025-27156` · CVE record: Enalean tuleap · CVSS 4.1 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: Cross-site scripting (XSS) - [Tuleap dumps the Redis password into the generated troubleshooting archives](https://agentprime.io/advisories/CVE-2025-27150.md) `CVE-2025-27150` · CVE record: Enalean tuleap · CVSS 5.3 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: Information disclosure - [Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message](https://agentprime.io/advisories/CVE-2025-27099.md) `CVE-2025-27099` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS) - [Tuleap allows default values to be cleared from field configuration](https://agentprime.io/advisories/CVE-2025-27094.md) `CVE-2025-27094` · CVE record: Enalean tuleap · CVSS 5.4 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-440 - [Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap](https://agentprime.io/advisories/CVE-2025-22129.md) `CVE-2025-22129` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 3 Feb 2025 · Tags: CWE-280 - [Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap](https://agentprime.io/advisories/CVE-2025-24029.md) `CVE-2025-24029` · CVE record: Enalean tuleap · CVSS 5.3 Medium · Not analysed yet · Published 3 Feb 2025 · Tags: CWE-280 - [Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin](https://agentprime.io/advisories/CVE-2024-52599.md) `CVE-2024-52599` · CVE record: Enalean tuleap · CVSS 5.4 Medium · Not analysed yet · Published 9 Dec 2024 · Tags: Cross-site scripting (XSS) - [Tuleap lists trackers in the quick add actions of the backlog without any permissions check](https://agentprime.io/advisories/CVE-2024-47767.md) `CVE-2024-47767` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-280 - [Permissions are incorrectly verified for project administrators in the cross tracker search widget](https://agentprime.io/advisories/CVE-2024-47766.md) `CVE-2024-47766` · CVE record: Enalean tuleap · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-280 - [Tuleap does not properly check permissions for email notifications in trackers](https://agentprime.io/advisories/CVE-2024-46988.md) `CVE-2024-46988` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-280 - [Tuleap vulnerable to XSS in the HTML mail content of the cross reference field](https://agentprime.io/advisories/CVE-2024-46980.md) `CVE-2024-46980` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Cross-site scripting (XSS) - [Tuleap's recursive permissions to document manager folder are not properly applied](https://agentprime.io/advisories/CVE-2024-39902.md) `CVE-2024-39902` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 22 Jul 2024 · Tags: CWE-281 - [Tuleap has improper permissions of the backlog items](https://agentprime.io/advisories/CVE-2024-37167.md) `CVE-2024-37167` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 25 Jun 2024 · Tags: Broken access control - [Tuleap deleting or moving an artifact can delete values from unrelated artifacts](https://agentprime.io/advisories/CVE-2024-30246.md) `CVE-2024-30246` · CVE record: Enalean tuleap · CVSS 7.6 High · Not analysed yet · Published 29 Mar 2024 · Tags: CWE-440, CWE-670 - [Tuleap's mass update clears the permissions on artifact field](https://agentprime.io/advisories/CVE-2024-25130.md) `CVE-2024-25130` · CVE record: Enalean tuleap · CVSS 5.4 Medium · Not analysed yet · Published 22 Feb 2024 · Tags: Information disclosure - [Tuleap's content of artifacts might be readable by unauthorized users](https://agentprime.io/advisories/CVE-2024-23344.md) `CVE-2024-23344` · CVE record: Enalean tuleap · CVSS 5.3 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: Information disclosure - [Tuleap vulnerable to Cross-site Scripting on the edition page of a release](https://agentprime.io/advisories/CVE-2023-48715.md) `CVE-2023-48715` · CVE record: Enalean tuleap · CVSS 5.4 Medium · Not analysed yet · Published 11 Dec 2023 · Tags: Cross-site scripting (XSS) - [Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion](https://agentprime.io/advisories/CVE-2023-39521.md) `CVE-2023-39521` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 24 Aug 2023 · Tags: Cross-site scripting (XSS) - [Tuleap allows preview of a linked artifact with a type does not respect permissions](https://agentprime.io/advisories/CVE-2023-38508.md) `CVE-2023-38508` · CVE record: Enalean tuleap · CVSS 6.5 Medium · Not analysed yet · Published 24 Aug 2023 · Tags: Broken access control - [Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps](https://agentprime.io/advisories/CVE-2023-35929.md) `CVE-2023-35929` · CVE record: Enalean tuleap · CVSS 5.4 Medium · Not analysed yet · Published 25 Jul 2023 · Tags: Cross-site scripting (XSS) - [User access not updated with privilege change in Tuleap](https://agentprime.io/advisories/CVE-2023-35938.md) `CVE-2023-35938` · CVE record: Enalean tuleap · CVSS 4.1 Medium · Not analysed yet · Published 29 Jun 2023 · Tags: CWE-281 - [Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job](https://agentprime.io/advisories/CVE-2023-32072.md) `CVE-2023-32072` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 29 May 2023 · Tags: Cross-site scripting (XSS) - [XSS in the tooltip via an artifact title](https://agentprime.io/advisories/CVE-2023-30619.md) `CVE-2023-30619` · CVE record: Enalean tuleap · CVSS 5.4 Medium · Not analysed yet · Published 4 May 2023 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting (XSS) through the name of a color of select box values in tuleap](https://agentprime.io/advisories/CVE-2023-23938.md) `CVE-2023-23938` · CVE record: Enalean tuleap · CVSS 5.9 Medium · Not analysed yet · Published 20 Apr 2023 · Tags: Cross-site scripting (XSS) - [Tuleap MediaWiki standalone "readers" can also edit pages](https://agentprime.io/advisories/CVE-2022-23473.md) `CVE-2022-23473` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: Broken access control - [Tuleap dashboards vulnerable to Incorrect Authorization](https://agentprime.io/advisories/CVE-2022-46160.md) `CVE-2022-46160` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: Broken access control - [Tuleap subject to Missing Authorization allowing for branch prefix modification](https://agentprime.io/advisories/CVE-2022-39233.md) `CVE-2022-39233` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2022 · Tags: Broken access control - [Fine grained permissions are not checked in Tuleap](https://agentprime.io/advisories/CVE-2022-31128.md) `CVE-2022-31128` · CVE record: Enalean tuleap · CVSS 5.4 Medium · Not analysed yet · Published 1 Aug 2022 · Tags: Broken access control - [SQL injection via the field name of a tracker in Tuleap](https://agentprime.io/advisories/CVE-2022-31058.md) `CVE-2022-31058` · CVE record: Enalean tuleap · CVSS 7.2 High · Not analysed yet · Published 29 Jun 2022 · Tags: SQL injection - [Cross site scripting via the title of a document in Tuleap](https://agentprime.io/advisories/CVE-2022-31063.md) `CVE-2022-31063` · CVE record: Enalean tuleap · CVSS 6.5 Medium · Not analysed yet · Published 29 Jun 2022 · Tags: Cross-site scripting (XSS) - [Resources of private projects can be exposed in Tuleap](https://agentprime.io/advisories/CVE-2022-31032.md) `CVE-2022-31032` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 29 Jun 2022 · Tags: Information disclosure - [Tracker report renderer and chart widgets leak information in Tuleap](https://agentprime.io/advisories/CVE-2022-24896.md) `CVE-2022-24896` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 6 Jun 2022 · Tags: Broken access control - [SQL injection in Tuleap](https://agentprime.io/advisories/CVE-2021-43806.md) `CVE-2021-43806` · CVE record: Enalean tuleap · CVSS 8.8 High · Not analysed yet · Published 15 Dec 2021 · Tags: SQL injection - [Indirect LDAP injection in Tuleap](https://agentprime.io/advisories/CVE-2021-41276.md) `CVE-2021-41276` · CVE record: Enalean tuleap · CVSS 6.7 Medium · Not analysed yet · Published 15 Dec 2021 · Tags: Other injection - [Indirect LDAP injection in Tuleap](https://agentprime.io/advisories/CVE-2021-43782.md) `CVE-2021-43782` · CVE record: Enalean tuleap · CVSS 6.7 Medium · Not analysed yet · Published 15 Dec 2021 · Tags: Other injection - [SQL injection in the "SVN core" commits browser](https://agentprime.io/advisories/CVE-2021-41154.md) `CVE-2021-41154` · CVE record: Enalean tuleap · CVSS 8.8 High · Not analysed yet · Published 18 Oct 2021 · Tags: SQL injection - [SQL injection in CVS revisions browser](https://agentprime.io/advisories/CVE-2021-41155.md) `CVE-2021-41155` · CVE record: Enalean tuleap · CVSS 8.8 High · Not analysed yet · Published 18 Oct 2021 · Tags: SQL injection - [The update of the CI job targeted by a widget is vulnerable to blind SQL injections](https://agentprime.io/advisories/CVE-2021-41148.md) `CVE-2021-41148` · CVE record: Enalean tuleap · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2021 · Tags: SQL injection Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .