Advisories · Technology
tolgee-platform.
Every CVE that names tolgee-platform among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.3 CriticalCritical · CVSS 9+
Tolgee has an XXE Injection in Translation Import
- tolgee-platform
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Tolgee's configuration all configuration properties leaked in public configuration DTO
- tolgee-platform
- Information disclosure
- CVSS 6.5 Medium
Tolgee' API keys created by server admin users bypass the permission check
- tolgee-platform
- Broken access control
- CVSS 2.7 Low
Tolgee's API key scopes not checked when querying translation data
- tolgee-platform
- Broken access control
- CVSS 5.5 Medium
HTML Injection with email in Tolgee
- tolgee-platform
- Cross-site scripting (XSS)
- CWE-20
- CVSS 8.1 High
Tolgee Lacks Permission Check for API Key for some endpoints
- tolgee-platform
- Broken access control