Kovah vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20256
3. 202611

Newest CVEs

• CVE-2026-49436

  LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API

  Kovah · LinkAce

  High7.3
• CVE-2026-45342

  LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes

  Kovah · LinkAce

  High7.1
• CVE-2026-45343

  LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session Hijacking

  Kovah · LinkAce

  High8.5
• CVE-2026-45344

  LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances

  Kovah · LinkAce

  High8.1
• CVE-2026-40905

  LinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover

  Kovah · LinkAce

  High8.1
• CVE-2026-35516

  LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection

  Kovah · LinkAce

  Medium5.0
• CVE-2026-33954

  LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

  Kovah · LinkAce

  Medium6.5
• CVE-2026-33953

  LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce

  Kovah · LinkAce

  High8.5
• CVE-2026-30954

  LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy()

  Kovah · LinkAce

  Medium5.3
• CVE-2026-30953

  LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest

  Kovah · LinkAce

  High7.7