Enalean vulnerabilities
62 CVEs and advisories name Enalean as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-24007Tuleap is missing CSRF protection in the Overview inconsistent items
- CVE-2025-65962Tuleap has missing CSRF protections its in tracker field dependencies
- CVE-2025-64760Tuleap has missing CSRF protections in its tracker trigger management system
- CVE-2025-64499Tuleap is missing CSRF protections for its planning management API
- CVE-2025-64498Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2025-64497Tuleap exposes releases for all projects to File Release System project administrators
- CVE-2025-64482Tuleap missing CSRF protections in the File Release System
- CVE-2025-64117Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags
- CVE-2025-59040Tuleap backlog item representations do not verify the permissions of the child trackers
- CVE-2025-54877Tuleap's special and always there fields permissions are not verified in cross-tracker search
- CVE-2025-53902Tuleap exposes artifacts to a mentioned user via email notifications
- CVE-2025-53541Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifact
- CVE-2025-52899Tuleap vulnerable to user enumeration via the lost password form
- CVE-2025-50179Tuleap missing CSRF protection on tracker reports manipulation
- CVE-2025-48991Tuleap missing CSRF protection on tracker canned responses administration
- CVE-2025-30155Tuleap does not enforce read permissions on parent trackers in the REST API
- CVE-2025-30209Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin
- CVE-2025-30203Tuleap allows XSS via the content of RSS feeds in the RSS widgets
- CVE-2025-29929Tuleap is missing CSRF protection on tracker hierarchy administration
- CVE-2025-29766Tuleap has missing CSRF protections on artifact submission & edition from the tracker view
- CVE-2025-27402Tuleap is missing CSRF protections on tracker fields administrative operations
- CVE-2025-27401In Tuleap, deleting a report can delete criteria filters in other reports
- CVE-2025-27156Tuleap allows content injection via emails sent by the mass emailing features
- CVE-2025-27150Tuleap dumps the Redis password into the generated troubleshooting archives
- CVE-2025-27099Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message
- CVE-2025-27094Tuleap allows default values to be cleared from field configuration
- CVE-2025-22129Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap
- CVE-2025-24029Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap
- CVE-2024-52599Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin
- CVE-2024-47767Tuleap lists trackers in the quick add actions of the backlog without any permissions check