CVE-2026-29090 | High | 8.8 | 2026-05-06 | ### Summary
A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgre… |
CVE-2026-29080 | High | 8.8 | 2026-05-06 | A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database t… |
CVE-2026-33046 | High | 8.8 | 2026-03-23 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabil… |
CVE-2026-28352 | Medium | 6.5 | 2026-02-27 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint… |
CVE-2026-25736 | Medium | 6.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25735 | Medium | 6.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25734 | Medium | 6.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25733 | High | 7.3 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25138 | Medium | 5.3 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior t… |
CVE-2026-25136 | High | 8.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A refle… |
CVE-2026-25739 | Medium | 5.4 | 2026-02-19 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cro… |
CVE-2026-25738 | Medium | 4.3 | 2026-02-19 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to ser… |
CVE-2025-59035 | Medium | 4.6 | 2025-09-10 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-… |
CVE-2025-59034 | Medium | 4.3 | 2025-09-10 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrie… |
CVE-2025-53640 | Medium | 6.5 | 2025-07-14 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3… |
CVE-2024-50633 | Unrated | | 2025-01-16 | A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the… |
CVE-2024-45399 | Medium | 4.3 | 2024-09-04 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, correspondin… |
CVE-2023-37901 | Medium | 5.4 | 2023-07-21 | Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly use… |
CVE-2023-22581 | Critical | 9.8 | 2023-04-24 | White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the d… |
CVE-2023-22577 | Critical | 9.8 | 2023-04-24 | Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings. |
CVE-2021-30185 | High | 7.5 | 2021-04-07 | CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link. |
CVE-2017-1000203 | High | 8.8 | 2017-11-17 | ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution |