indico has 13 CVEs on record between 2025 and 2026. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 4.5 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.5
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-33046HighIndico discloses local files resulting in Remote Code Execution through LaTeX injection 41CVE-2025-53640MediumIndico vulnerability allows attackers to bulk dump user details40CVE-2026-107394Medium· 6.8Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask37CVE-2026-28352Medium· 6.5Indico has a missing access check in the event series management API36CVE-2026-107396Medium· 5.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask30
indico vulnerabilities
CVEs affecting indico, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-108388Low· 3.5Indico is a feature-rich event management system
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management per…
CVE-2026-107397Medium· 4.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event mi…
CVE-2026-107396Medium· 5.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafte…
CVE-2026-107395Medium· 4.3Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session…
CVE-2026-107394Medium· 6.8Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a cra…
CVE-2026-33046HighIndico discloses local files resulting in Remote Code Execution through LaTeX injection
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
CVE-2026-28352Medium· 6.5Indico has a missing access check in the event series management API
Indico has a missing access check in the event series management API
CVE-2026-25739Medium· 5.4Indico Affected by Cross-Site-Scripting via material uploads
Indico Affected by Cross-Site-Scripting via material uploads
CVE-2026-25738MediumIndico has Server-Side Request Forgery (SSRF) in multiple places
Indico has Server-Side Request Forgery (SSRF) in multiple places
CVE-2025-59035Medium· 4.6Indico vulnerable to Cross-Site Scripting via LaTeX math code
Indico vulnerable to Cross-Site Scripting via LaTeX math code
CVE-2025-59034Medium· 4.3Indico may disclose unauthorized user details access via legacy API
Indico may disclose unauthorized user details access via legacy API
CVE-2025-53640MediumPoCIndico vulnerability allows attackers to bulk dump user details
Indico vulnerability allows attackers to bulk dump user details
CVE-2024-50633None· 0.0PoCIndico Insecure Access
Indico Insecure Access