Semaphoreui Semaphore
5 CVEs affecting Semaphoreui Semaphore. Latest disclosed: 2026-09-15. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73294 | Critical | 9.9 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --uploa… |
CVE-2026-73293 | High | 8.8 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGloba… |
CVE-2026-73292 | High | 8.3 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authe… |
CVE-2026-91994 | Medium | 6.5 | 2026-09-15 | Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner… |