# traccar. Every CVE that names traccar among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Traccar: Authentication bypass via path parameters exposes protected device media](https://agentprime.io/advisories/CVE-2026-104203.md) `CVE-2026-104203` · CVE record: traccar traccar · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Authentication bypass - [Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback](https://agentprime.io/advisories/CVE-2026-108738.md) `CVE-2026-108738` · CVE record: Traccar Traccar · CVSS 2.3 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site request forgery (CSRF) - [Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion](https://agentprime.io/advisories/CVE-2026-108737.md) `CVE-2026-108737` · CVE record: Traccar Traccar · CVSS 7.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: CWE-640 - [Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle](https://agentprime.io/advisories/CVE-2026-52852.md) `CVE-2026-52852` · CVE record: traccar traccar · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service - [Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions](https://agentprime.io/advisories/CVE-2026-52851.md) `CVE-2026-52851` · CVE record: traccar traccar · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection - [Traccar: Missing edit authorization on device image upload allows read-only users to write files](https://agentprime.io/advisories/CVE-2026-44314.md) `CVE-2026-44314` · CVE record: traccar traccar · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Broken access control - [traccar allows stored HTML injection in notification emails](https://agentprime.io/advisories/CVE-2026-27694.md) `CVE-2026-27694` · CVE record: traccar traccar · CVSS 5.4 Medium · Not analysed yet · Published 5 May 2026 · Tags: Cross-site scripting (XSS) - [traccar allows XML injection in KML and GPX exports](https://agentprime.io/advisories/CVE-2026-27693.md) `CVE-2026-27693` · CVE record: traccar traccar · CVSS 5.4 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [traccar allows CSV formula injection via exported position data](https://agentprime.io/advisories/CVE-2026-27644.md) `CVE-2026-27644` · CVE record: traccar traccar · CVSS 6.5 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection - [Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints](https://agentprime.io/advisories/CVE-2026-25649.md) `CVE-2026-25649` · CVE record: traccar traccar · CVSS 7.3 High · Not analysed yet · Published 23 Feb 2026 · Tags: Cross-site request forgery (CSRF), Open redirect - [Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload](https://agentprime.io/advisories/CVE-2026-25648.md) `CVE-2026-25648` · CVE record: traccar traccar · CVSS 8.7 High · Not analysed yet · Published 23 Feb 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload - [Traccar vulnerable to Path Traversal and External Control of File Name or Path](https://agentprime.io/advisories/CVE-2026-23521.md) `CVE-2026-23521` · CVE record: traccar traccar · CVSS 6.5 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: Path traversal - [Traccar Missing Origin Validation in WebSockets](https://agentprime.io/advisories/CVE-2025-68930.md) `CVE-2025-68930` · CVE record: traccar traccar · CVSS 7.1 High · Not analysed yet · Published 23 Feb 2026 · Tags: CWE-1385 - [Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File](https://agentprime.io/advisories/CVE-2025-61666.md) `CVE-2025-61666` · CVE record: traccar traccar · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2025 · Tags: Path traversal - [Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution](https://agentprime.io/advisories/CVE-2024-31214.md) `CVE-2024-31214` · CVE record: traccar traccar · CVSS 9.7 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.18 · Not analysed yet · Published 10 Apr 2024 · Tags: Unrestricted file upload - [Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type](https://agentprime.io/advisories/CVE-2024-24809.md) `CVE-2024-24809` · CVE record: traccar traccar · CVSS 8.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.54 · Not analysed yet · Published 10 Apr 2024 · Tags: Unrestricted file upload, CWE-27 - [An unrestricted file upload vulnerability in traccar leads to RCE](https://agentprime.io/advisories/CVE-2023-50729.md) `CVE-2023-50729` · CVE record: traccar traccar · CVSS 8.5 High · Not analysed yet · Published 15 Jan 2024 · Tags: Unrestricted file upload - [Unquoted Windows binary path in Traccar](https://agentprime.io/advisories/CVE-2021-21292.md) `CVE-2021-21292` · CVE record: traccar traccar · CVSS 5.5 Medium · Not analysed yet · Published 2 Feb 2021 · Tags: CWE-428 - [LDAP injection vulnerability in Traccar GPS Tracking System](https://agentprime.io/advisories/CVE-2020-5246.md) `CVE-2020-5246` · CVE record: Traccar Traccar · CVSS 7.7 High · Not analysed yet · Published 14 Jul 2020 · Tags: Other injection ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .