traPtitech has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.3 (high).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 0% vs 1% corpus
Median CVSS: 7.3
Publish → KEV: —
Last 90 days: 2 prev 0

Weakness classes

Products

traQ 2

Follow traPtitech:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

traPtitech vulnerabilities

CVEs affecting traPtitech, newest first. Open any entry for full detail, references, and exploit status.

2 CVEsRSS

CVE-2026-63197High· 7.3

5d ago

traQ: XSS in the User Uploaded File Retrieval API

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct …

▾ TwilighttraPtitech · traQEPSS 0.29%via CVEORG

CVE-2026-63198High· 7.3

5d ago

traQ: Privilege escalation by OAuth prompt=none request

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope …

▾ TwilighttraPtitech · traQEPSS 0.26%via CVEORG