humhub vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20222
3. 20254
4. 20268

Newest CVEs

• CVE-2026-115541

  HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation

  HumHub · HumHub Community Edition

  High7.2
• CVE-2026-93769

  HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

  Humhub · Humhub

  High7.2
• CVE-2026-18430

  HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason

  HumHub · HumHub

  High7.2
• CVE-2026-18756

  HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering

  HumHub · HumHub

  High7.2
• CVE-2026-18526

  HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

  HumHub · HumHub

  High7.4
• CVE-2026-47657

  HumHub Missing Authorization on Remove All Space Members Action

  humhub · humhub

  High7.1
• CVE-2026-29048

  HumHub: XSS in Button component

  humhub · humhub

  Medium6.9
• CVE-2026-29052

  HumHub Calendar Module: Stored XSS in Event Types

  humhub · calendar

  Medium6.9
• CVE-2025-65963

  CFiles Unauthorized Folder/ZIP Access in Public Spaces

  humhub · cfiles

  Medium5.4
• CVE-2025-64442

  HumHub is vulnerable to XSS through its Meta Search component

  humhub · humhub

  High7.1