CVE-2026-48745 | Critical | 9.3 | 2026-06-17 | Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and belo… |
CVE-2026-44314 | Medium | 4.3 | 2026-05-26 | Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User… |
CVE-2026-27694 | Medium | 5.4 | 2026-05-05 | Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-c… |
CVE-2026-27693 | Medium | 5.4 | 2026-05-05 | Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes de… |
CVE-2026-27644 | Medium | 6.5 | 2026-05-05 | Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-control… |
CVE-2026-25649 | High | 7.3 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorizat… |
CVE-2026-25648 | High | 8.7 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in… |
CVE-2026-23521 | Medium | 6.5 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices… |
CVE-2025-68930 | High | 7.1 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/… |
CVE-2025-61666 | | | 2025-10-02 | Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5… |
CVE-2024-7746 | Critical | 9.8 | 2024-08-13 | Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the… |
CVE-2024-31214 | Critical | 9.6 | 2024-04-10 | Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Atta… |
CVE-2024-24809 | High | 8.5 | 2024-04-10 | Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Sinc… |
CVE-2023-50729 | High | 8.4 | 2024-01-15 | Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers… |
CVE-2021-21292 | Medium | 5.5 | 2021-02-02 | Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are… |
CVE-2020-5246 | High | 7.7 | 2020-07-14 | Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing… |
CVE-2019-5748 | Critical | 9.8 | 2019-01-09 | In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks. |
CVE-2018-1000881 | Critical | 9.8 | 2018-12-20 | Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in ComputedAttributes… |