CVE Tools
Track your stack

Humhub

2 CVEs tracked since 2015. Since Jan 2015, none of them reached CISA KEV.

Humhub CVEs per month

Jan 2015 to Jun 2016. Point at a month, or focus the strip and use the arrow keys.
Humhub CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2015-0110
2015-02null or fewer
2015-03null or fewer
2015-04null or fewer
2015-05null or fewer
2015-06null or fewer
2015-07null or fewer
2015-08null or fewer
2015-09null or fewer
2015-10null or fewer
2015-11null or fewer
2015-12null or fewer
2016-01null or fewer
2016-02null or fewer
2016-03null or fewer
2016-04null or fewer
2016-05null or fewer
2016-0610

Products

The products that kept showing up in Humhub's monthly top three, with their CVEs summed over those months.

  1. Humhub22 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Humhub.

  1. CVE-2026-93769HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover—
  2. CVE-2026-18430HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason—
  3. CVE-2026-18756HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering—
  4. CVE-2026-18526HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation—
  5. CVE-2026-47657HumHub Missing Authorization on Remove All Space Members Action—
  6. CVE-2026-29048HumHub: XSS in Button component—
  7. CVE-2026-29052HumHub Calendar Module: Stored XSS in Event Types6.1
  8. CVE-2025-65963CFiles Unauthorized Folder/ZIP Access in Public Spaces5.4
  9. CVE-2025-64442HumHub is vulnerable to XSS through its Meta Search component6.1
  10. CVE-2025-54790Files: Potential for SQL Injection through File Browse and List Operations6.5
  11. CVE-2025-54789Files is Vulnerable to Reflected Self-XSS through its File Move Functionality6.1
  12. CVE-2024-52043User enumeration in HubHub5.3
  13. CVE-2022-31133Cross site scripting in HumHub5.9
  14. CVE-2017-20028HumHub privileges management5.6
  15. CVE-2017-20027HumHub DOM cross site scriting4.3

The record

Peak rank
#109 in Jun 2016
Busiest month shown
Jan 2015, 1 CVEs
Months with a KEV entry
0 since Jan 2015
Monthly snapshots
2 since 2015
Humhub's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store