hotcrp vulnerabilities

CVEs whose affected-version data names the hotcrp package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-55493Medium· 6.5

1w ago

HotCRP: comment-author search exposes anonymous commenter identities

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A `cmt:USER` search can th…

▾ Sunlitkohler · hotcrpEPSS 0.30%via CVEORG