Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-63497

titra: residual mass assignment via customfields in timeentry/create and project/task/create

titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Titraio
Products
Titra
CVE-2026-42092

Global Settings Publication Exposes Sensitive Configuration to Any Authenticated User in Titra

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Titraio
Products
Titra