{"items":[{"id":"CVE-2026-116020","published":"2026-10-24T11:40:36.328Z","updated":"2026-11-05T17:30:05.764Z","title":"BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages","severity":"MEDIUM","score":5.3,"vendor":"BookStackApp","product":"BookStack","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-89022","published":"2026-09-15T16:11:56.151Z","updated":"2026-10-01T15:21:50.290Z","title":"BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion","severity":"CRITICAL","score":9.1,"vendor":"bookstackapp","product":"bookstack","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-84695","published":"2026-09-02T00:37:51.655Z","updated":"2026-09-02T16:01:37.536Z","title":"BookStack before 26.05.4 Stored XSS via Drawing Upload","severity":"CRITICAL","score":9.3,"vendor":"bookstackapp","product":"bookstack","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-82450","published":"2026-08-29T13:47:53.312Z","updated":"2026-10-08T15:51:45.531Z","title":"BookStack before 26.05.4 Remote Code Execution via Book Cover","severity":"HIGH","score":8.7,"vendor":"bookstackapp","product":"bookstack","kev":false,"epss":0.00999,"kevAdded":null},{"id":"CVE-2026-67204","published":"2026-08-24T15:33:13.649Z","updated":"2026-10-01T15:20:17.762Z","title":"BookStack < 26.05.4 Broken Access Control via Image Gallery API","severity":"MEDIUM","score":5.3,"vendor":"BookStackApp","product":"BookStack","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-5484","published":"2026-04-03T19:45:12.967Z","updated":"2026-04-08T18:52:44.563Z","title":"BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control","severity":"MEDIUM","score":6.9,"vendor":"BookStackApp","product":"BookStack","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2023-4624","published":"2023-08-30T12:02:20.664Z","updated":"2024-10-01T18:39:14.627Z","title":"Server-Side Request Forgery (SSRF) in bookstackapp/bookstack","severity":"LOW","score":2.4,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2022-0877","published":"2022-03-08T12:40:09.000Z","updated":"2024-08-02T23:40:04.559Z","title":"Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack","severity":"HIGH","score":7.6,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.00782,"kevAdded":null},{"id":"CVE-2021-4194","published":"2022-01-06T17:35:10.000Z","updated":"2024-08-03T17:16:04.262Z","title":"Improper Access Control in bookstackapp/bookstack","severity":"MEDIUM","score":4.3,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.00731,"kevAdded":null},{"id":"CVE-2021-4119","published":"2021-12-15T17:25:10.000Z","updated":"2024-08-03T17:16:04.251Z","title":"Improper Access Control in bookstackapp/bookstack","severity":"MEDIUM","score":5.3,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.26893,"kevAdded":null},{"id":"CVE-2021-3944","published":"2021-12-02T16:40:10.000Z","updated":"2024-08-03T17:09:09.759Z","title":"Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack","severity":"LOW","score":3.1,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.00641,"kevAdded":null},{"id":"CVE-2021-4026","published":"2021-11-30T19:55:10.000Z","updated":"2024-08-03T17:16:03.288Z","title":"Improper Access Control in bookstackapp/bookstack","severity":"MEDIUM","score":6.5,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.00926,"kevAdded":null},{"id":"CVE-2021-3915","published":"2021-11-13T09:15:10.000Z","updated":"2024-08-03T17:09:09.642Z","title":"Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack","severity":"HIGH","score":7.6,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.00961,"kevAdded":null},{"id":"CVE-2021-3916","published":"2021-11-05T14:50:19.000Z","updated":"2024-08-03T17:09:09.688Z","title":"Path Traversal in bookstackapp/bookstack","severity":"MEDIUM","score":6.5,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.01241,"kevAdded":null},{"id":"CVE-2021-3906","published":"2021-10-27T21:20:10.000Z","updated":"2024-08-03T17:09:09.761Z","title":"Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack","severity":"MEDIUM","score":5.4,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.00668,"kevAdded":null},{"id":"CVE-2021-3874","published":"2021-10-15T13:40:18.000Z","updated":"2024-08-03T17:09:09.594Z","title":"Path Traversal in bookstackapp/bookstack","severity":"MEDIUM","score":4.3,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.01202,"kevAdded":null},{"id":"CVE-2021-3768","published":"2021-09-06T11:17:18.000Z","updated":"2024-08-03T17:09:08.651Z","title":"Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack","severity":"MEDIUM","score":5.4,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.0058,"kevAdded":null},{"id":"CVE-2021-3767","published":"2021-09-06T11:17:17.000Z","updated":"2024-08-03T17:09:08.832Z","title":"Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack","severity":"MEDIUM","score":5.4,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.0058,"kevAdded":null},{"id":"CVE-2021-3758","published":"2021-09-02T12:06:27.000Z","updated":"2024-08-03T17:09:08.264Z","title":"Server-Side Request Forgery (SSRF) in bookstackapp/bookstack","severity":"MEDIUM","score":6.3,"vendor":"bookstackapp","product":"bookstackapp/bookstack","kev":false,"epss":0.008,"kevAdded":null},{"id":"CVE-2020-26260","published":"2020-12-09T16:20:14.000Z","updated":"2024-08-04T15:56:04.938Z","title":"Server Side Request Forgery in BookStack","severity":"MEDIUM","score":6.4,"vendor":"BookStackApp","product":"BookStack","kev":false,"epss":0.00837,"kevAdded":null},{"id":"CVE-2020-26211","published":"2020-11-03T21:00:18.000Z","updated":"2024-08-04T15:49:07.293Z","title":"Cross-Site Scripting in BookStack","severity":"HIGH","score":7.7,"vendor":"BookStackApp","product":"BookStack","kev":false,"epss":0.01096,"kevAdded":null},{"id":"CVE-2020-26210","published":"2020-11-03T18:20:15.000Z","updated":"2024-08-04T15:49:07.224Z","title":"Cross-Site Scripting in BookStack","severity":"HIGH","score":7.7,"vendor":"BookStackApp","product":"BookStack","kev":false,"epss":0.01169,"kevAdded":null},{"id":"CVE-2020-11055","published":"2020-05-07T20:40:14.000Z","updated":"2024-08-04T11:21:14.640Z","title":"Cross-site Scripting in BookStack","severity":"MEDIUM","score":6.3,"vendor":"BookStackApp","product":"BookStack","kev":false,"epss":0.00782,"kevAdded":null},{"id":"CVE-2020-5256","published":"2020-03-09T15:50:22.000Z","updated":"2024-08-04T08:22:09.083Z","title":"Remote Code Execution Through Image Uploads in BookStack","severity":"HIGH","score":7.9,"vendor":"BookStackApp","product":"BookStack","kev":false,"epss":0.01969,"kevAdded":null}]}