What’s Vulnerable › Products

Enalean tuleap vulnerabilities

71 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your Enalean tuleap version is affected

Latest Enalean tuleap vulnerabilities

• CVE-2026-24007 — Tuleap is missing CSRF protection in the Overview inconsistent items (CVSS 4.6)
• CVE-2025-65962 — Tuleap has missing CSRF protections its in tracker field dependencies (CVSS 4.3)
• CVE-2025-64760 — Tuleap has missing CSRF protections in its tracker trigger management system (CVSS 4.3)
• CVE-2025-64499 — Tuleap is missing CSRF protections for its planning management API (CVSS 5.4)
• CVE-2025-64498 — Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
• CVE-2025-64497 — Tuleap exposes releases for all projects to File Release System project administrators (CVSS 6.5)
• CVE-2025-64482 — Tuleap missing CSRF protections in the File Release System (CVSS 4.6)
• CVE-2025-64117 — Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags (CVSS 4.6)
• CVE-2025-59040 — Tuleap backlog item representations do not verify the permissions of the child trackers (CVSS 4.3)
• CVE-2025-54877 — Tuleap's special and always there fields permissions are not verified in cross-tracker search (CVSS 5.3)
• CVE-2025-53902 — Tuleap exposes artifacts to a mentioned user via email notifications (CVSS 4.3)
• CVE-2025-53541 — Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifact (CVSS 5.4)
• CVE-2025-52899 — Tuleap vulnerable to user enumeration via the lost password form (CVSS 5.3)
• CVE-2025-50179 — Tuleap missing CSRF protection on tracker reports manipulation (CVSS 4.3)
• CVE-2025-48991 — Tuleap missing CSRF protection on tracker canned responses administration (CVSS 4.3)
• CVE-2025-30209 — Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin (CVSS 5.3)
• CVE-2025-30203 — Tuleap allows XSS via the content of RSS feeds in the RSS widgets (CVSS 4.8)
• CVE-2025-30155 — Tuleap does not enforce read permissions on parent trackers in the REST API (CVSS 4.3)
• CVE-2025-29929 — Tuleap is missing CSRF protection on tracker hierarchy administration (CVSS 4.3)
• CVE-2025-29766 — Tuleap has missing CSRF protections on artifact submission & edition from the tracker view (CVSS 4.3)
• CVE-2025-27402 — Tuleap is missing CSRF protections on tracker fields administrative operations (CVSS 4.6)
• CVE-2025-27401 — In Tuleap, deleting a report can delete criteria filters in other reports (CVSS 4.6)
• CVE-2025-27156 — Tuleap allows content injection via emails sent by the mass emailing features (CVSS 5.4)
• CVE-2025-27150 — Tuleap dumps the Redis password into the generated troubleshooting archives (CVSS 6.5)
• CVE-2025-27099 — Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message (CVSS 4.8)