Combodo iTop vulnerabilities

CVEs per yearBy the year they were published

1. 20205
2. 202111
3. 20226
4. 20234
5. 202424
6. 202516
7. 202622

Newest CVEs

• CVE-2026-108717

  Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController

  Combodo · iTop

  Medium5.3
• CVE-2026-40877

  Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences

  Combodo · iTop

  High8.7
• CVE-2026-30864

  Combodo iTop: Reflected XSS in dashboard revert

  Combodo · iTop

  High8.9
• CVE-2026-39975

  Combodo iTop: Remote code execution using external auth variable value

  Combodo · iTop

  Critical9.4
• CVE-2026-34949

  Combodo iTop: Unauthenticated user can delete .readonly file

  Combodo · iTop

  Medium6.5
• CVE-2026-34948

  Combodo iTop: Access control bypass via OQL joins

  Combodo · iTop

  High7.7
• CVE-2026-34836

  Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

  Combodo · iTop

  Medium6.5
• CVE-2026-34741

  Combodo iTop: Authentication bypass in exec.php allows PHP file execution

  Combodo · iTop

  High8.6
• CVE-2026-33333

  Combodo iTop: Information disclosure in ajax.render.php

  Combodo · iTop

  Low3.5
• CVE-2026-33240

  Combodo iTop: Reflected XSS in foreign key search criteria

  Combodo · iTop

  High8.8