bestpractical RT vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 20269

Newest CVEs

• CVE-2026-44230

  RT: Reflected Cross-Site Scripting in search results chart

  bestpractical · rt

  Medium6.1
• CVE-2026-44231

  RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

  bestpractical · rt

  Critical9.1
• CVE-2026-44229

  RT: Cross-Site Scripting via inline-served uploaded content

  bestpractical · rt

  Medium5.4
• CVE-2026-44228

  RT: Stored Cross-Site Scripting via insufficient template escaping

  bestpractical · rt

  Medium5.4
• CVE-2026-44227

  RT: Reflected Cross-Site Scripting via URL parameters

  bestpractical · rt

  Medium6.1
• CVE-2026-41076

  RT: LDAP authentication bypass via empty password

  bestpractical · rt

  High8.1
• CVE-2026-41075

  RT: SQL injection via entry_aggregator parameter in JSON search

  bestpractical · rt

  High8.8
• CVE-2026-41074

  RT has broken CSRF protection for authenticated users

  bestpractical · rt

  High7.1
• CVE-2026-41073

  RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps

  bestpractical · rt

  Medium4.6
• CVE-2025-31501

  Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.

  bestpractical · RT

  High7.2