Cern - vulnerabilities (CVEs)
22 CVEs in 4 products, 0 in the last 30 days, newest from 2026-05-06.
Products
- Indico - 11 CVEs
- Rucio - 8 CVEs
- White Rabbit Switch - 2 CVEs
- Root - 1 CVEs
Newest CVEs of Cern
- CVE-2026-29090 - CVSS 9 (critical), 2026-05-06: ### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in…
- CVE-2026-29080 - CVSS 9.4 (critical), 2026-05-06: A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database…
- CVE-2026-33046 - CVSS 8.8 (high), 2026-03-23: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to…
- CVE-2026-28352 - CVSS 6.5 (medium), 2026-02-27: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint…
- CVE-2026-25736 - CVSS 6.1 (medium), 2026-02-25: Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.…
- CVE-2026-25735 - CVSS 6.1 (medium), 2026-02-25: Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.…
- CVE-2026-25136 - CVSS 8.1 (high), 2026-02-25: Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A…
- CVE-2026-25734 - CVSS 6.1 (medium), 2026-02-25: Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.…
- CVE-2026-25733 - CVSS 7.3 (high), 2026-02-25: Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.…
- CVE-2026-25138 - CVSS 5.3 (medium), 2026-02-25: Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior…
- CVE-2026-25739 - CVSS 5.4 (medium), 2026-02-19: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to…
- CVE-2026-25738 - CVSS 6.9 (medium), 2026-02-19: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to…
- CVE-2025-59035 - CVSS 5.4 (medium), 2025-09-10: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a…
- CVE-2025-59034 - CVSS 4.3 (medium), 2025-09-10: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to…
- CVE-2025-53640 - CVSS 6.5 (medium), 2025-07-14: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version…
- CVE-2024-50633 - CVSS 7.5 (high), 2025-01-16: A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the…
- CVE-2024-45399 - CVSS 6.1 (medium), 2024-09-04: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4,…
- CVE-2023-37901 - CVSS 5.4 (medium), 2023-07-21: Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly…
- CVE-2023-22581 - CVSS 9.8 (critical), 2023-04-24: White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the…
- CVE-2023-22577 - CVSS 9.8 (critical), 2023-04-24: Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings.
- CVE-2021-30185 - CVSS 7.5 (high), 2021-04-07: CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
- CVE-2017-1000203 - CVSS 8.8 (high), 2017-11-17: ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution
