polonel has 12 CVEs on record. Disclosure cadence is accelerating: 12 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 12. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-639 (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 12 prev 0
Weakness classes
Products
- trudesk 12
Worst active — by depth score
CVE-2026-114397High· 7.4Trudesk through 1.2.11 Missing Authentication on Debug Routes53CVE-2026-114396High· 7.1Trudesk through 1.2.11 MongoDB $where Injection via tickets search API51CVE-2026-114400Medium· 5.9Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads45CVE-2026-114401Medium· 5.3Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login41CVE-2026-114392Medium· 5.3Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid41
polonel vulnerabilities
CVEs affecting polonel, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-114393Medium· 4.3PoCTrudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary tic…
CVE-2026-114392Medium· 5.3PoCTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket'…
CVE-2026-114396High· 7.1PoCTrudesk through 1.2.11 MongoDB $where Injection via tickets search API
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api…
CVE-2026-114395Medium· 4.3PoCTrudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cI…
CVE-2026-114394Medium· 4.3Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, po…
CVE-2026-114399Medium· 6.5Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file value…
CVE-2026-114398Medium· 5.4Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can s…
CVE-2026-114397High· 7.4PoCTrudesk through 1.2.11 Missing Authentication on Debug Routes
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups,…
CVE-2026-114401Medium· 5.3PoCTrudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes lik…
CVE-2026-114400Medium· 5.9PoCTrudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-gu…
CVE-2026-114402Medium· 4.3PoCTrudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attack…
CVE-2026-111345Medium· 4.3Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, w…