Cern Indico vulnerabilities

• cern indico Indico discloses local files resulting in Remote Code Execution through LaTeX injection CVE-2026-33046 Fix available 7.7 HighMarch 23, 2026
• cern indico Indico missing access check in event series management API CVE-2026-28352 Fix available 6.5 MediumFebruary 27, 2026
• cern indico Indico affected by Cross-Site-Scripting via material uploads CVE-2026-25739 Fix available 5.4 MediumFebruary 17, 2026
• cern indico Indico has Server-Side Request Forgery (SSRF) in multiple places CVE-2026-25738 Fix available 6.9 MediumFebruary 17, 2026
• cern indico Indico vulnerable to Cross-Site Scripting via LaTeX math code CVE-2025-59035 Fix available 4.6 MediumSeptember 10, 2025
• cern indico Indico may disclose unauthorized user details access via legacy API CVE-2025-59034 Fix available 4.3 MediumSeptember 10, 2025
• cern indico Indico vulnerable to user enumeration via API endpoint CVE-2025-53640 Public exploitFix available 5.3 MediumJuly 14, 2025
• cern indico Indico Insecure Access CVE-2024-50633 Public exploitFix availableDisputed 0.0 NoneJanuary 16, 2025
• cern indico Indico has a Cross-Site-Scripting during account creation CVE-2024-45399 Fix available 4.3 MediumSeptember 4, 2024
• cern indico Cross-Site-Scripting via confirmation prompts CVE-2023-37901 Fix available 5.4 MediumJuly 21, 2023
• cern indico Indico Tampering with links (e.g. password reset) in sent emails CVE-2021-30185 Fix available 7.5 HighApril 7, 2021