Skip to content
Sonarsource vulnerabilities
Newest
-
sonarqube
In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users...
CVE-2025-62292
4.3 Medium
-
sonarsource sonarqube-scan-action
Argument injection vulnerability in SonarQube Scan Action
CVE-2025-59844
Fix available
7.7 High
-
sonarsource sonarqube-scan-action
Command Injection via sonarqube-scan-action GitHub Action
CVE-2025-58178
Fix available
7.8 High
-
sonarsource sonarqube
In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the...
CVE-2024-47911
6.7 Medium
-
sonarsource sonarqube
An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A...
CVE-2024-47910
7.2 High
-
sonarsource sonarqube
SonarQube logs sensitive information
CVE-2024-38460
Fix available
4.9 Medium
-
sonarsource sonarqube docker image
The official sonarqube docker images before alpine (Alpine specific) contain a blank password for...
CVE-2020-35193
9.8 Critical
-
sonarsource sonarqube
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through...
CVE-2020-28002
5.3 Medium
-
sonarsource sonarqube
** DISPUTED ** SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and...
CVE-2020-27986
Disputed
EPSS 16.0%
7.5 High
-
sonarsource sonarqube
SonarSource SonarQube before 7.8 has XSS in project links on account/projects.
CVE-2019-17579
6.1 Medium
-
sonarsource sonarqube scanner
Jenkins SonarQube Scanner Plugin stored server authentication token in plain text
CVE-2018-1000425
Fix available
7.8 High
-
sonarsource sonarqube
Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API
CVE-2018-19413
Fix available
4.3 Medium
-
sonarsource jenkins plugin
Jenkins SonarQube Plugin Stores Passwords in Cleartext
CVE-2013-5676
Public exploit
4.0 Medium