firefly-iii vulnerabilities

CVEs per yearBy the year they were published

1. 202112
2. 20233
3. 20241
4. 20261

Newest CVEs

• CVE-2026-71250

  Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding

  firefly-iii · firefly-iii

  Medium4.3
• CVE-2024-37893

  MFA bypass in oauth flow in Firefly III

  firefly-iii · firefly-iii

  Medium5.9
• CVE-2023-1788

  Insufficient Session Expiration in firefly-iii/firefly-iii

  firefly-iii · firefly-iii/firefly-iii

  Medium5.4
• CVE-2023-1789

  Improper Input Validation in firefly-iii/firefly-iii

  firefly-iii · firefly-iii/firefly-iii

  Medium5.2
• CVE-2023-0298

  Incorrect Authorization in firefly-iii/firefly-iii

  firefly-iii · firefly-iii/firefly-iii

  Medium6.5
• CVE-2021-4005

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii · firefly-iii/firefly-iii

  Medium4.3
• CVE-2021-4015

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii · firefly-iii/firefly-iii

  Medium4.3
• CVE-2021-3921

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii · firefly-iii/firefly-iii

  Medium5.4
• CVE-2021-3901

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii · firefly-iii/firefly-iii

  Low3.5
• CVE-2021-3900

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii · firefly-iii/firefly-iii

  Medium4.3