Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Sep 21, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-61749 · Other software · inventree · reported by GitHubMedium 6.5
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-61748 · Other software · inventree · reported by GitHubMedium 4.3
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-61747 · Other software · inventree · reported by GitHubMedium 4.3
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no assigned roles, can supply another user's import session identifier and retrieve that session's row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users, although the InvenTree threat model treats authenticated instance users as trusted. This issue is fixed in version 1.4.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-61746 · Other software · inventree · reported by GitHubMedium 5.3
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-61744 · Other software · inventree · reported by GitHubMedium 6.5
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-61745 · Other software · inventree · reported by GitHubMedium 4.3
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-39362 · Other software · inventree · reported by GitHubMedium 5.3
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django's URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35479 · Other software · inventree · reported by GitHubMedium 6.6
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.inventree.orgdocs.inventree.org
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35478 · Other software · inventree · reported by GitHubHigh 8.3
InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35477 · Other software · inventree · reported by GitHubMedium 5.5
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35476 · Other software · inventree · reported by GitHubHigh 7.2
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.inventree.orggithub.com
Mar 26, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-33531 · Other software · inventree · reported by GitHubMedium 4.9
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: `encode_svg_image()`, `asset()`, and `uploaded_image()` in `src/backend/InvenTree/report/templatetags/report.py`. This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-33530 · Other software · inventree · reported by GitHubHigh 7.7
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django's __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-27629 · Other software · inventree · reported by GitHubMedium 5.9
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to the client. When generating custom batch codes, the InvenTree server makes use of a customizable jinja2 template, which can be modified by a staff user to exfiltrate sensitive information or perform code execution on the server. This issue requires access by a user with granted staff permissions, followed by a request to generate a custom batch code via the API. Once the template has been modified in a malicious manner, the API call to generate a new batch code could be made by other users, and the template code will be executed with their user context. The code has been patched to ensure that all template generation is performed within a secure sandboxed context. This issue has been addressed in version 1.2.3, and any versions from 1.3.0 onwards. Some workarounds are available. The batch code template is a configurable global setting which can be adjusted via any user with staff access. To prevent this setting from being edited, it can be overridden at a system level to a default value, preventing it from being edited. This
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025InvenTree is an Open Source Inventory Management System.CVE-2025-49000 · Other software · inventree · reported by GitHubLow 3.5
InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024InvenTree is an Open Source Inventory Management System.CVE-2024-47610 · Other software · inventree · reported by GitHubHigh 7.3
InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store javascript in markdown notes fields, which are then displayed to other logged in users who visit the same page and executed. The vulnerability has been addressed as follows: 1. HTML sanitization has been enabled in the front-end markdown rendering library - `easymde`. 2. Stored markdown is also validated on the backend, to ensure that malicious markdown is not stored in the database. These changes are available in release versions 0.16.5 and later. All users are advised to upgrade. There are no workarounds, an update is required to get the new validation functions.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.CVE-2022-3355 · Other software · inventree · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.
- Product
- inventree/inventree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0.CVE-2022-2134 · Other software · inventree · reported by security@huntr.devMedium 6.5
Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0.
- Product
- inventree/inventree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-2113 · Other software · inventree · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.
- Product
- inventree/inventree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-2112 · Other software · inventree · reported by security@huntr.devHigh 8.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.
- Product
- inventree/inventree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-2111 · Other software · inventree · reported by security@huntr.devHigh 8.8
Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.
- Product
- inventree/inventree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.