Sonarsource Sonarqube vulnerabilities

• sonarqube In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users... CVE-2025-62292 4.3 MediumOctober 10, 2025
• sonarsource sonarqube-scan-action Argument injection vulnerability in SonarQube Scan Action CVE-2025-59844 Fix available 7.7 HighSeptember 26, 2025
• sonarsource sonarqube-scan-action Command Injection via sonarqube-scan-action GitHub Action CVE-2025-58178 Fix available 7.8 HighSeptember 2, 2025
• sonarsource sonarqube In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the... CVE-2024-47911 6.7 MediumOctober 4, 2024
• sonarsource sonarqube An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A... CVE-2024-47910 7.2 HighOctober 4, 2024
• sonarsource sonarqube SonarQube logs sensitive information CVE-2024-38460 Fix available 4.9 MediumJune 16, 2024
• sonarsource sonarqube docker image The official sonarqube docker images before alpine (Alpine specific) contain a blank password for... CVE-2020-35193 9.8 CriticalDecember 15, 2020
• sonarsource sonarqube In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through... CVE-2020-28002 5.3 MediumOctober 30, 2020
• sonarsource sonarqube ** DISPUTED ** SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and... CVE-2020-27986 Disputed EPSS 16.0% 7.5 HighOctober 28, 2020
• sonarsource sonarqube SonarSource SonarQube before 7.8 has XSS in project links on account/projects. CVE-2019-17579 6.1 MediumOctober 14, 2019
• sonarsource sonarqube scanner Jenkins SonarQube Scanner Plugin stored server authentication token in plain text CVE-2018-1000425 Fix available 7.8 HighJanuary 9, 2019
• sonarsource sonarqube Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API CVE-2018-19413 Fix available 4.3 MediumDecember 14, 2018