oqtane.framework vulnerabilities
CVEs whose affected-version data names the oqtane.framework package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-122008Medium· 5.0Oqtane Framework before 10.3.0 SSRF via File Upload From URL
Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-…
▾ Sunlitoqtane · oqtane.frameworkEPSS 0.26%via CVEORG
CVE-2026-122007Medium· 6.5Oqtane Framework before 10.3.0 Broken Access Control via SettingController
Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by…
▾ Sunlitoqtane · oqtane.frameworkEPSS 0.38%via CVEORG