bestpractical vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202610

Newest CVEs

• CVE-2026-44230

  RT: Reflected Cross-Site Scripting in search results chart

  bestpractical · rt

  Medium6.1
• CVE-2026-44231

  RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

  bestpractical · rt

  Critical9.1
• CVE-2026-44229

  RT: Cross-Site Scripting via inline-served uploaded content

  bestpractical · rt

  Medium5.4
• CVE-2026-44228

  RT: Stored Cross-Site Scripting via insufficient template escaping

  bestpractical · rt

  Medium5.4
• CVE-2026-44227

  RT: Reflected Cross-Site Scripting via URL parameters

  bestpractical · rt

  Medium6.1
• CVE-2026-41076

  RT: LDAP authentication bypass via empty password

  bestpractical · rt

  High8.1
• CVE-2026-41075

  RT: SQL injection via entry_aggregator parameter in JSON search

  bestpractical · rt

  High8.8
• CVE-2026-41074

  RT has broken CSRF protection for authenticated users

  bestpractical · rt

  High7.1
• CVE-2026-41073

  RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps

  bestpractical · rt

  Medium4.6
• CVE-2025-61873

  Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.

  bestpractical · Request Tracker

  Low2.6