oqtane has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 5.0 (medium). Most affected products: oqtane.framework (2), Oqtane Framework (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.0
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-122007Medium· 6.5Oqtane Framework before 10.3.0 Broken Access Control via SettingController36CVE-2026-122008Medium· 5.0Oqtane Framework before 10.3.0 SSRF via File Upload From URL28CVE-2026-111616Medium· 4.9Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings27
oqtane vulnerabilities
CVEs affecting oqtane, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-122008Medium· 5.0Oqtane Framework before 10.3.0 SSRF via File Upload From URL
Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-…
CVE-2026-122007Medium· 6.5Oqtane Framework before 10.3.0 Broken Access Control via SettingController
Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by…
CVE-2026-111616Medium· 4.9Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site ca…