Rt
48 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Rt, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.
Rt CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 3 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 4 |
| 2026-06 | 0 |
| 2026-07 | 5 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 48 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High7
- Medium35
- Low5
Latest CVEs
The 15 most recently published vulnerabilities affecting Rt.
- CVE-2026-44230RT: Reflected Cross-Site Scripting in search results chart6.1
- CVE-2026-44231RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint9.1
- CVE-2026-44229RT: Cross-Site Scripting via inline-served uploaded content5.4
- CVE-2026-44228RT: Stored Cross-Site Scripting via insufficient template escaping5.4
- CVE-2026-44227RT: Reflected Cross-Site Scripting via URL parameters6.1
- CVE-2026-41076RT: LDAP authentication bypass via empty password8.1
- CVE-2026-41075RT: SQL injection via entry_aggregator parameter in JSON search8.8
- CVE-2026-41074RT has broken CSRF protection for authenticated users7.1
- CVE-2026-41073RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps4.6
- CVE-2025-31501Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.7.2
- CVE-2025-30087Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.7.2
- CVE-2025-31500Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.7.2
- CVE-2014-1474Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string with...5.0
- CVE-2013-3371Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an a...4.3
- CVE-2013-3373CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks...5.0
Product grouping is registry-driven, with AI assist and human review. How it works