glpi-project has 16 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 14 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 13. The median CVSS is 6.8 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-862 (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 14 prev 0
Worst active — by depth score
CVE-2026-53625High· 7.5GLPI is a free asset and IT management software package53CVE-2026-48482Critical· 9.4GLPI is a free asset and IT management software package52CVE-2026-53629High· 7.1GLPI is a free asset and IT management software package51CVE-2026-55214High· 8.5GLPI is a free asset and IT management software package47CVE-2026-47679High· 8.5GLPI is a free asset and IT management software package47
glpi-project vulnerabilities
CVEs affecting glpi-project, newest first. Open any entry for full detail, references, and exploit status.
16 CVEsRSS
CVE-2026-108726Medium· 4.3GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype…
CVE-2026-49469Medium· 4.6GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter…
CVE-2026-53628Medium· 5.9GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor…
CVE-2026-45801Medium· 5.3GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege bou…
CVE-2026-55214High· 8.5GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored …
CVE-2026-53610High· 7.5GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL …
CVE-2026-49470High· 7.7GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentic…
CVE-2026-53626High· 7.1GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can …
CVE-2026-48482Critical· 9.4GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The i…
CVE-2026-53629High· 7.1PoCGLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This…
CVE-2026-55217Medium· 5.3GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization fo…
CVE-2026-53627Medium· 6.0GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the …
CVE-2026-47679High· 8.5GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selecte…
CVE-2026-53625High· 7.5PoCGLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the le…
CVE-2025-64520Medium· 6.5GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a pa…
CVE-2025-59935Medium· 6.5GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive…