# cve.now: Enalean

The newest entries naming Enalean as an affected vendor (up to 200), of 62 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-24007](https://cve.now/CVE-2026-24007.md): Tuleap is missing CSRF protection in the Overview inconsistent items (CVSS 4.6)
- [CVE-2025-65962](https://cve.now/CVE-2025-65962.md): Tuleap has missing CSRF protections its in tracker field dependencies (CVSS 4.6)
- [CVE-2025-64760](https://cve.now/CVE-2025-64760.md): Tuleap has missing CSRF protections in its tracker trigger management system (CVSS 4.6)
- [CVE-2025-64499](https://cve.now/CVE-2025-64499.md): Tuleap is missing CSRF protections for its planning management API (CVSS 4.6)
- [CVE-2025-64498](https://cve.now/CVE-2025-64498.md): Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.6)
- [CVE-2025-64497](https://cve.now/CVE-2025-64497.md): Tuleap exposes releases for all projects to File Release System project administrators (CVSS 6.5)
- [CVE-2025-64482](https://cve.now/CVE-2025-64482.md): Tuleap missing CSRF protections in the File Release System (CVSS 4.6)
- [CVE-2025-64117](https://cve.now/CVE-2025-64117.md): Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags (CVSS 4.6)
- [CVE-2025-59040](https://cve.now/CVE-2025-59040.md): Tuleap backlog item representations do not verify the permissions of the child trackers (CVSS 4.3)
- [CVE-2025-54877](https://cve.now/CVE-2025-54877.md): Tuleap's special and always there fields permissions are not verified in cross-tracker search (CVSS 5.3)
- [CVE-2025-53902](https://cve.now/CVE-2025-53902.md): Tuleap exposes artifacts to a mentioned user via email notifications (CVSS 4.3)
- [CVE-2025-53541](https://cve.now/CVE-2025-53541.md): Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifact (CVSS 5.4)
- [CVE-2025-52899](https://cve.now/CVE-2025-52899.md): Tuleap vulnerable to user enumeration via the lost password form (CVSS 5.3)
- [CVE-2025-50179](https://cve.now/CVE-2025-50179.md): Tuleap missing CSRF protection on tracker reports manipulation (CVSS 4.6)
- [CVE-2025-48991](https://cve.now/CVE-2025-48991.md): Tuleap missing CSRF protection on tracker canned responses administration (CVSS 4.6)
- [CVE-2025-30155](https://cve.now/CVE-2025-30155.md): Tuleap does not enforce read permissions on parent trackers in the REST API (CVSS 4.3)
- [CVE-2025-30209](https://cve.now/CVE-2025-30209.md): Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin (CVSS 5.3)
- [CVE-2025-30203](https://cve.now/CVE-2025-30203.md): Tuleap allows XSS via the content of RSS feeds in the RSS widgets (CVSS 4.8)
- [CVE-2025-29929](https://cve.now/CVE-2025-29929.md): Tuleap is missing CSRF protection on tracker hierarchy administration (CVSS 4.6)
- [CVE-2025-29766](https://cve.now/CVE-2025-29766.md): Tuleap has missing CSRF protections on artifact submission & edition from the tracker view (CVSS 4.6)
- [CVE-2025-27402](https://cve.now/CVE-2025-27402.md): Tuleap is missing CSRF protections on tracker fields administrative operations (CVSS 4.6)
- [CVE-2025-27401](https://cve.now/CVE-2025-27401.md): In Tuleap, deleting a report can delete criteria filters in other reports (CVSS 4.6)
- [CVE-2025-27156](https://cve.now/CVE-2025-27156.md): Tuleap allows content injection via emails sent by the mass emailing features (CVSS 4.1)
- [CVE-2025-27150](https://cve.now/CVE-2025-27150.md): Tuleap dumps the Redis password into the generated troubleshooting archives (CVSS 5.3)
- [CVE-2025-27099](https://cve.now/CVE-2025-27099.md): Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message (CVSS 4.8)
- [CVE-2025-27094](https://cve.now/CVE-2025-27094.md): Tuleap allows default values to be cleared from field configuration (CVSS 5.4)
- [CVE-2025-22129](https://cve.now/CVE-2025-22129.md): Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap (CVSS 4.3)
- [CVE-2025-24029](https://cve.now/CVE-2025-24029.md): Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap (CVSS 5.3)
- [CVE-2024-52599](https://cve.now/CVE-2024-52599.md): Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin (CVSS 5.4)
- [CVE-2024-47767](https://cve.now/CVE-2024-47767.md): Tuleap lists trackers in the quick add actions of the backlog without any permissions check (CVSS 4.3)
- [CVE-2024-47766](https://cve.now/CVE-2024-47766.md): Permissions are incorrectly verified for project administrators in the cross tracker search widget (CVSS 4.9)
- [CVE-2024-46988](https://cve.now/CVE-2024-46988.md): Tuleap does not properly check permissions for email notifications in trackers (CVSS 4.8)
- [CVE-2024-46980](https://cve.now/CVE-2024-46980.md): Tuleap vulnerable to XSS in the HTML mail content of the cross reference field (CVSS 4.8)
- [CVE-2024-39902](https://cve.now/CVE-2024-39902.md): Tuleap's recursive permissions to document manager folder are not properly applied (CVSS 4.8)
- [CVE-2024-37167](https://cve.now/CVE-2024-37167.md): Tuleap has improper permissions of the backlog items (CVSS 4.3)
- [CVE-2024-30246](https://cve.now/CVE-2024-30246.md): Tuleap deleting or moving an artifact can delete values from unrelated artifacts (CVSS 7.6)
- [CVE-2024-25130](https://cve.now/CVE-2024-25130.md): Tuleap's mass update clears the permissions on artifact field (CVSS 5.4)
- [CVE-2024-23344](https://cve.now/CVE-2024-23344.md): Tuleap's content of artifacts might be readable by unauthorized users (CVSS 5.3)
- [CVE-2023-48715](https://cve.now/CVE-2023-48715.md): Tuleap vulnerable to Cross-site Scripting on the edition page of a release (CVSS 5.4)
- [CVE-2023-39521](https://cve.now/CVE-2023-39521.md): Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion (CVSS 4.8)
- [CVE-2023-38508](https://cve.now/CVE-2023-38508.md): Tuleap allows preview of a linked artifact with a type does not respect permissions (CVSS 6.5)
- [CVE-2023-35929](https://cve.now/CVE-2023-35929.md): Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps (CVSS 5.4)
- [CVE-2023-35938](https://cve.now/CVE-2023-35938.md): User access not updated with privilege change in Tuleap (CVSS 4.1)
- [CVE-2023-32072](https://cve.now/CVE-2023-32072.md): Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job (CVSS 4.8)
- [CVE-2023-30619](https://cve.now/CVE-2023-30619.md): XSS in the tooltip via an artifact title (CVSS 5.4)
- [CVE-2023-23938](https://cve.now/CVE-2023-23938.md): Cross-site Scripting (XSS) through the name of a color of select box values in tuleap (CVSS 5.9)
- [CVE-2022-23473](https://cve.now/CVE-2022-23473.md): Tuleap MediaWiki standalone "readers" can also edit pages (CVSS 4.3)
- [CVE-2022-46160](https://cve.now/CVE-2022-46160.md): Tuleap dashboards vulnerable to Incorrect Authorization (CVSS 4.3)
- [CVE-2022-39233](https://cve.now/CVE-2022-39233.md): Tuleap subject to Missing Authorization allowing for branch prefix modification (CVSS 4.3)
- [CVE-2022-31128](https://cve.now/CVE-2022-31128.md): Fine grained permissions are not checked in Tuleap (CVSS 5.4)
- [CVE-2022-31058](https://cve.now/CVE-2022-31058.md): SQL injection via the field name of a tracker in Tuleap (CVSS 7.2)
- [CVE-2022-31063](https://cve.now/CVE-2022-31063.md): Cross site scripting via the title of a document in Tuleap (CVSS 6.5)
- [CVE-2022-31032](https://cve.now/CVE-2022-31032.md): Resources of private projects can be exposed in Tuleap (CVSS 4.3)
- [CVE-2022-24896](https://cve.now/CVE-2022-24896.md): Tracker report renderer and chart widgets leak information in Tuleap (CVSS 4.3)
- [CVE-2021-43806](https://cve.now/CVE-2021-43806.md): SQL injection in Tuleap (CVSS 8.8)
- [CVE-2021-41276](https://cve.now/CVE-2021-41276.md): Indirect LDAP injection in Tuleap (CVSS 6.7)
- [CVE-2021-43782](https://cve.now/CVE-2021-43782.md): Indirect LDAP injection in Tuleap (CVSS 6.7)
- [CVE-2021-41154](https://cve.now/CVE-2021-41154.md): SQL injection in the "SVN core" commits browser (CVSS 8.8)
- [CVE-2021-41155](https://cve.now/CVE-2021-41155.md): SQL injection in CVS revisions browser (CVSS 8.8)
- [CVE-2021-41148](https://cve.now/CVE-2021-41148.md): The update of the CI job targeted by a widget is vulnerable to blind SQL injections (CVSS 8.8)
- [CVE-2021-41147](https://cve.now/CVE-2021-41147.md): SQL injection in the planning edition panel (CVSS 7.2)
- [CVE-2021-41142](https://cve.now/CVE-2021-41142.md): XSS via the name of a deleted attachment (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/enalean
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.