{"schema_version":1,"title":"Combodo iTop vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 21 vulnerabilities in Combodo iTop: 0 in the last 7 days and 21 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-40877, was published on 24 August 2026.","url":"https://junglewise.ai/threats/technologies/itop","json_url":"https://junglewise.ai/threats/technologies/itop.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/itop","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":15,"all_time":21,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":21,"last_365_days":21},"latest":[{"cve":"CVE-2026-40877","cvss":8.7,"epss":0.0053,"slug":"cve-2026-40877-combodo-itop-php-object-injection-in-user-preferences","title":"Combodo iTop PHP object injection in user preferences","severity":"high","exploited":false,"published_at":"2026-08-24T19:16:38.647+00:00","url":"https://junglewise.ai/threats/cve-2026-40877-combodo-itop-php-object-injection-in-user-preferences"},{"cve":"CVE-2026-39975","cvss":9.4,"epss":0.0059,"slug":"cve-2026-39975-combodo-itop-remote-code-execution-via-unsafe-eval","title":"Combodo iTop remote code execution via unsafe eval","severity":"info","exploited":false,"published_at":"2026-08-24T19:16:38.47+00:00","url":"https://junglewise.ai/threats/cve-2026-39975-combodo-itop-remote-code-execution-via-unsafe-eval"},{"cve":"CVE-2026-30864","cvss":8.9,"epss":0.0035,"slug":"cve-2026-30864-combodo-itop-reflected-xss-in-dashboard-revert","title":"Combodo iTop reflected XSS in dashboard revert","severity":"high","exploited":false,"published_at":"2026-08-24T19:16:37.14+00:00","url":"https://junglewise.ai/threats/cve-2026-30864-combodo-itop-reflected-xss-in-dashboard-revert"},{"cve":"CVE-2026-34949","cvss":6.5,"epss":0.0037,"slug":"cve-2026-34949-combodo-itop-readonly-file-deletion-by-unauthenticated-users","title":"Combodo iTop .readonly file deletion by unauthenticated users","severity":"medium","exploited":false,"published_at":"2026-08-21T23:16:24.297+00:00","url":"https://junglewise.ai/threats/cve-2026-34949-combodo-itop-readonly-file-deletion-by-unauthenticated-users"},{"cve":"CVE-2026-34948","cvss":7.7,"epss":0.0039,"slug":"cve-2026-34948-combodo-itop-access-control-bypass-in-oql-joins","title":"Combodo iTop access control bypass in OQL joins","severity":"high","exploited":false,"published_at":"2026-08-21T23:16:24.153+00:00","url":"https://junglewise.ai/threats/cve-2026-34948-combodo-itop-access-control-bypass-in-oql-joins"},{"cve":"CVE-2026-34836","cvss":6.5,"epss":0.0039,"slug":"cve-2026-34836-combodo-itop-improper-access-control-in-document-handling","title":"Combodo iTop improper access control in document handling","severity":"medium","exploited":false,"published_at":"2026-08-21T22:16:37.29+00:00","url":"https://junglewise.ai/threats/cve-2026-34836-combodo-itop-improper-access-control-in-document-handling"},{"cve":"CVE-2026-34741","cvss":8.6,"epss":0.0064,"slug":"cve-2026-34741-combodo-itop-authentication-bypass-in-exec-php","title":"Combodo iTop authentication bypass in exec.php","severity":"high","exploited":false,"published_at":"2026-08-21T22:16:37.143+00:00","url":"https://junglewise.ai/threats/cve-2026-34741-combodo-itop-authentication-bypass-in-exec-php"},{"cve":"CVE-2026-33333","cvss":3.5,"epss":0.0028,"slug":"cve-2026-33333-combodo-itop-sensitive-information-disclosure-in-error-messages","title":"Combodo iTop sensitive information disclosure in error messages","severity":"low","exploited":false,"published_at":"2026-08-21T22:16:37.003+00:00","url":"https://junglewise.ai/threats/cve-2026-33333-combodo-itop-sensitive-information-disclosure-in-error-messages"},{"cve":"CVE-2026-33240","cvss":8.8,"epss":0.0047,"slug":"cve-2026-33240-combodo-itop-reflected-xss-in-foreign-key-search","title":"Combodo iTop reflected XSS in foreign key search","severity":"high","exploited":false,"published_at":"2026-08-21T22:16:36.863+00:00","url":"https://junglewise.ai/threats/cve-2026-33240-combodo-itop-reflected-xss-in-foreign-key-search"},{"cve":"CVE-2026-33047","cvss":4.3,"epss":0.0037,"slug":"cve-2026-33047-combodo-itop-privilege-escalation-in-object-locking","title":"Combodo iTop privilege escalation in object locking","severity":"medium","exploited":false,"published_at":"2026-08-21T22:16:36.717+00:00","url":"https://junglewise.ai/threats/cve-2026-33047-combodo-itop-privilege-escalation-in-object-locking"},{"cve":"CVE-2026-31936","cvss":8.8,"epss":0.0048,"slug":"cve-2026-31936-combodo-itop-unauthorized-access-via-search-operation","title":"Combodo iTop unauthorized access via search operation","severity":"high","exploited":false,"published_at":"2026-08-21T22:16:36.553+00:00","url":"https://junglewise.ai/threats/cve-2026-31936-combodo-itop-unauthorized-access-via-search-operation"},{"cve":"CVE-2026-31880","cvss":8,"epss":0.0043,"slug":"cve-2026-31880-combodo-itop-reflected-xss-in-universal-search","title":"Combodo iTop reflected XSS in universal search","severity":"high","exploited":false,"published_at":"2026-08-21T21:16:57.403+00:00","url":"https://junglewise.ai/threats/cve-2026-31880-combodo-itop-reflected-xss-in-universal-search"},{"cve":"CVE-2026-31803","cvss":8,"epss":0.0043,"slug":"cve-2026-31803-combodo-itop-reflected-xss-in-tag-admin","title":"Combodo iTop reflected XSS in tag admin","severity":"high","exploited":false,"published_at":"2026-08-21T21:16:57.25+00:00","url":"https://junglewise.ai/threats/cve-2026-31803-combodo-itop-reflected-xss-in-tag-admin"},{"cve":"CVE-2026-30890","cvss":8,"epss":0.0043,"slug":"cve-2026-30890-combodo-itop-reflected-xss-in-synchro-import-script","title":"Combodo iTop reflected XSS in synchro import script","severity":"high","exploited":false,"published_at":"2026-08-21T21:16:57.103+00:00","url":"https://junglewise.ai/threats/cve-2026-30890-combodo-itop-reflected-xss-in-synchro-import-script"},{"cve":"CVE-2026-30865","cvss":7.1,"epss":0.0026,"slug":"cve-2026-30865-combodo-itop-reflected-xss-in-dashboard-save","title":"Combodo iTop reflected XSS in dashboard save","severity":"high","exploited":false,"published_at":"2026-08-21T21:16:56.97+00:00","url":"https://junglewise.ai/threats/cve-2026-30865-combodo-itop-reflected-xss-in-dashboard-save"},{"cve":"CVE-2026-30826","cvss":8,"epss":0.0043,"slug":"cve-2026-30826-combodo-itop-reflected-xss-in-oql-query-functionality","title":"Combodo iTop reflected XSS in OQL query functionality","severity":"high","exploited":false,"published_at":"2026-08-21T21:16:56.83+00:00","url":"https://junglewise.ai/threats/cve-2026-30826-combodo-itop-reflected-xss-in-oql-query-functionality"},{"cve":"CVE-2026-30866","cvss":7.5,"epss":0.0046,"slug":"cve-2026-30866-combodo-itop-unauthenticated-image-access-via-url","title":"Combodo iTop unauthenticated image access via URL","severity":"high","exploited":false,"published_at":"2026-08-21T20:16:34.453+00:00","url":"https://junglewise.ai/threats/cve-2026-30866-combodo-itop-unauthenticated-image-access-via-url"},{"cve":"CVE-2026-30819","cvss":7.3,"epss":0.0037,"slug":"cve-2026-30819-combodo-itop-reflected-xss-in-dashboard-revert","title":"Combodo iTop reflected XSS in dashboard revert","severity":"high","exploited":false,"published_at":"2026-08-21T20:16:34.313+00:00","url":"https://junglewise.ai/threats/cve-2026-30819-combodo-itop-reflected-xss-in-dashboard-revert"},{"cve":"CVE-2026-27490","cvss":7.5,"epss":0.0043,"slug":"cve-2026-27490-combodo-itop-weak-inline-image-secret-exposure","title":"Combodo iTop weak inline image secret exposure","severity":"high","exploited":false,"published_at":"2026-08-21T20:16:34.157+00:00","url":"https://junglewise.ai/threats/cve-2026-27490-combodo-itop-weak-inline-image-secret-exposure"},{"cve":"CVE-2026-27463","cvss":5.3,"epss":0.0034,"slug":"cve-2026-27463-combodo-itop-version-disclosure-in-login-page-logo","title":"Combodo iTop version disclosure in login page logo","severity":"medium","exploited":false,"published_at":"2026-08-21T20:16:34.017+00:00","url":"https://junglewise.ai/threats/cve-2026-27463-combodo-itop-version-disclosure-in-login-page-logo"},{"cve":"CVE-2026-27462","cvss":7.5,"epss":0.0043,"slug":"cve-2026-27462-combodo-itop-user-enumeration-in-password-reset","title":"Combodo iTop user enumeration in password reset","severity":"high","exploited":false,"published_at":"2026-08-21T20:16:33.87+00:00","url":"https://junglewise.ai/threats/cve-2026-27462-combodo-itop-user-enumeration-in-password-reset"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":18},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Combodo iTop","slug":"itop","vendor":{"name":"Combodo","slug":"combodo","url":"https://junglewise.ai/threats/vendors/combodo"},"aliases":[],"category":"web-application","url":"https://junglewise.ai/threats/technologies/itop"},"most_severe":[{"cve":"CVE-2026-30864","cvss":8.9,"epss":0.0035,"slug":"cve-2026-30864-combodo-itop-reflected-xss-in-dashboard-revert","title":"Combodo iTop reflected XSS in dashboard revert","severity":"high","exploited":false,"published_at":"2026-08-24T19:16:37.14+00:00","url":"https://junglewise.ai/threats/cve-2026-30864-combodo-itop-reflected-xss-in-dashboard-revert"},{"cve":"CVE-2026-31936","cvss":8.8,"epss":0.0048,"slug":"cve-2026-31936-combodo-itop-unauthorized-access-via-search-operation","title":"Combodo iTop unauthorized access via search operation","severity":"high","exploited":false,"published_at":"2026-08-21T22:16:36.553+00:00","url":"https://junglewise.ai/threats/cve-2026-31936-combodo-itop-unauthorized-access-via-search-operation"},{"cve":"CVE-2026-33240","cvss":8.8,"epss":0.0047,"slug":"cve-2026-33240-combodo-itop-reflected-xss-in-foreign-key-search","title":"Combodo iTop reflected XSS in foreign key search","severity":"high","exploited":false,"published_at":"2026-08-21T22:16:36.863+00:00","url":"https://junglewise.ai/threats/cve-2026-33240-combodo-itop-reflected-xss-in-foreign-key-search"},{"cve":"CVE-2026-40877","cvss":8.7,"epss":0.0053,"slug":"cve-2026-40877-combodo-itop-php-object-injection-in-user-preferences","title":"Combodo iTop PHP object injection in user preferences","severity":"high","exploited":false,"published_at":"2026-08-24T19:16:38.647+00:00","url":"https://junglewise.ai/threats/cve-2026-40877-combodo-itop-php-object-injection-in-user-preferences"},{"cve":"CVE-2026-34741","cvss":8.6,"epss":0.0064,"slug":"cve-2026-34741-combodo-itop-authentication-bypass-in-exec-php","title":"Combodo iTop authentication bypass in exec.php","severity":"high","exploited":false,"published_at":"2026-08-21T22:16:37.143+00:00","url":"https://junglewise.ai/threats/cve-2026-34741-combodo-itop-authentication-bypass-in-exec-php"},{"cve":"CVE-2026-31880","cvss":8,"epss":0.0043,"slug":"cve-2026-31880-combodo-itop-reflected-xss-in-universal-search","title":"Combodo iTop reflected XSS in universal search","severity":"high","exploited":false,"published_at":"2026-08-21T21:16:57.403+00:00","url":"https://junglewise.ai/threats/cve-2026-31880-combodo-itop-reflected-xss-in-universal-search"},{"cve":"CVE-2026-31803","cvss":8,"epss":0.0043,"slug":"cve-2026-31803-combodo-itop-reflected-xss-in-tag-admin","title":"Combodo iTop reflected XSS in tag admin","severity":"high","exploited":false,"published_at":"2026-08-21T21:16:57.25+00:00","url":"https://junglewise.ai/threats/cve-2026-31803-combodo-itop-reflected-xss-in-tag-admin"},{"cve":"CVE-2026-30890","cvss":8,"epss":0.0043,"slug":"cve-2026-30890-combodo-itop-reflected-xss-in-synchro-import-script","title":"Combodo iTop reflected XSS in synchro import script","severity":"high","exploited":false,"published_at":"2026-08-21T21:16:57.103+00:00","url":"https://junglewise.ai/threats/cve-2026-30890-combodo-itop-reflected-xss-in-synchro-import-script"},{"cve":"CVE-2026-30826","cvss":8,"epss":0.0043,"slug":"cve-2026-30826-combodo-itop-reflected-xss-in-oql-query-functionality","title":"Combodo iTop reflected XSS in OQL query functionality","severity":"high","exploited":false,"published_at":"2026-08-21T21:16:56.83+00:00","url":"https://junglewise.ai/threats/cve-2026-30826-combodo-itop-reflected-xss-in-oql-query-functionality"},{"cve":"CVE-2026-34948","cvss":7.7,"epss":0.0039,"slug":"cve-2026-34948-combodo-itop-access-control-bypass-in-oql-joins","title":"Combodo iTop access control bypass in OQL joins","severity":"high","exploited":false,"published_at":"2026-08-21T23:16:24.153+00:00","url":"https://junglewise.ai/threats/cve-2026-34948-combodo-itop-access-control-bypass-in-oql-joins"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}