Traccar vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20211
3. 20244
4. 20251
5. 202614

Newest CVEs

• CVE-2026-104203

  Traccar: Authentication bypass via path parameters exposes protected device media

  traccar · traccar

  High7.5
• CVE-2026-108738

  Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback

  Traccar · Traccar

  Low2.3
• CVE-2026-108737

  Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion

  Traccar · Traccar

  High7.6
• CVE-2026-52852

  Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle

  traccar · traccar

  Medium6.5
• CVE-2026-52851

  Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions

  traccar · traccar

  High7.1
• CVE-2026-48745

  Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry

  traccar · traccar-client

  Critical9.3
• CVE-2026-44314

  Traccar: Missing edit authorization on device image upload allows read-only users to write files

  traccar · traccar

  Medium5.3
• CVE-2026-27694

  traccar allows stored HTML injection in notification emails

  traccar · traccar

  Medium5.4
• CVE-2026-27693

  traccar allows XML injection in KML and GPX exports

  traccar · traccar

  Medium5.4
• CVE-2026-27644

  traccar allows CSV formula injection via exported position data

  traccar · traccar

  Medium6.5