# Combodo vulnerabilities

Source: https://junglewise.ai/threats/vendors/combodo  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/combodo.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 24 vulnerabilities in Combodo: 0 in the last 7 days and 22 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-108717, was published on 11 October 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. 1 technology has a page of its own.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 22
- All time: 24 (0 critical, 0 exploited in the wild)

## About Combodo

Company providing IT service management and automation software solutions.

## Latest Combodo vulnerabilities

- [CVE-2026-108717: Combodo iTop missing authorization in LinkSetController](https://junglewise.ai/threats/cve-2026-108717-combodo-itop-3-1-0-through-3-3-0-contains-a-missing) (medium, CVSS 6.3, published 11 Oct 2026)
- [CVE-2026-40877: Combodo iTop PHP object injection in user preferences](https://junglewise.ai/threats/cve-2026-40877-combodo-itop-php-object-injection-in-user-preferences) (high, CVSS 8.7, published 24 Aug 2026)
- [CVE-2026-39975: Combodo iTop remote code execution via unsafe eval](https://junglewise.ai/threats/cve-2026-39975-combodo-itop-remote-code-execution-via-unsafe-eval) (info, CVSS 9.4, published 24 Aug 2026)
- [CVE-2026-30864: Combodo iTop reflected XSS in dashboard revert](https://junglewise.ai/threats/cve-2026-30864-combodo-itop-reflected-xss-in-dashboard-revert) (high, CVSS 8.9, published 24 Aug 2026)
- [CVE-2026-34949: Combodo iTop .readonly file deletion by unauthenticated users](https://junglewise.ai/threats/cve-2026-34949-combodo-itop-readonly-file-deletion-by-unauthenticated-users) (medium, CVSS 6.5, published 21 Aug 2026)
- [CVE-2026-34948: Combodo iTop access control bypass in OQL joins](https://junglewise.ai/threats/cve-2026-34948-combodo-itop-access-control-bypass-in-oql-joins) (high, CVSS 7.7, published 21 Aug 2026)
- [CVE-2026-34836: Combodo iTop improper access control in document handling](https://junglewise.ai/threats/cve-2026-34836-combodo-itop-improper-access-control-in-document-handling) (medium, CVSS 6.5, published 21 Aug 2026)
- [CVE-2026-34741: Combodo iTop authentication bypass in exec.php](https://junglewise.ai/threats/cve-2026-34741-combodo-itop-authentication-bypass-in-exec-php) (high, CVSS 8.6, published 21 Aug 2026)
- [CVE-2026-33333: Combodo iTop sensitive information disclosure in error messages](https://junglewise.ai/threats/cve-2026-33333-combodo-itop-sensitive-information-disclosure-in-error-messages) (low, CVSS 3.5, published 21 Aug 2026)
- [CVE-2026-33240: Combodo iTop reflected XSS in foreign key search](https://junglewise.ai/threats/cve-2026-33240-combodo-itop-reflected-xss-in-foreign-key-search) (high, CVSS 8.8, published 21 Aug 2026)
- [CVE-2026-33047: Combodo iTop privilege escalation in object locking](https://junglewise.ai/threats/cve-2026-33047-combodo-itop-privilege-escalation-in-object-locking) (medium, CVSS 4.3, published 21 Aug 2026)
- [CVE-2026-31936: Combodo iTop unauthorized access via search operation](https://junglewise.ai/threats/cve-2026-31936-combodo-itop-unauthorized-access-via-search-operation) (high, CVSS 8.8, published 21 Aug 2026)
- [CVE-2026-31880: Combodo iTop reflected XSS in universal search](https://junglewise.ai/threats/cve-2026-31880-combodo-itop-reflected-xss-in-universal-search) (high, CVSS 8, published 21 Aug 2026)
- [CVE-2026-31803: Combodo iTop reflected XSS in tag admin](https://junglewise.ai/threats/cve-2026-31803-combodo-itop-reflected-xss-in-tag-admin) (high, CVSS 8, published 21 Aug 2026)
- [CVE-2026-30890: Combodo iTop reflected XSS in synchro import script](https://junglewise.ai/threats/cve-2026-30890-combodo-itop-reflected-xss-in-synchro-import-script) (high, CVSS 8, published 21 Aug 2026)
- [CVE-2026-30865: Combodo iTop reflected XSS in dashboard save](https://junglewise.ai/threats/cve-2026-30865-combodo-itop-reflected-xss-in-dashboard-save) (high, CVSS 7.1, published 21 Aug 2026)
- [CVE-2026-30826: Combodo iTop reflected XSS in OQL query functionality](https://junglewise.ai/threats/cve-2026-30826-combodo-itop-reflected-xss-in-oql-query-functionality) (high, CVSS 8, published 21 Aug 2026)
- [CVE-2026-30866: Combodo iTop unauthenticated image access via URL](https://junglewise.ai/threats/cve-2026-30866-combodo-itop-unauthenticated-image-access-via-url) (high, CVSS 7.5, published 21 Aug 2026)
- [CVE-2026-30819: Combodo iTop reflected XSS in dashboard revert](https://junglewise.ai/threats/cve-2026-30819-combodo-itop-reflected-xss-in-dashboard-revert) (high, CVSS 7.3, published 21 Aug 2026)
- [CVE-2026-27490: Combodo iTop weak inline image secret exposure](https://junglewise.ai/threats/cve-2026-27490-combodo-itop-weak-inline-image-secret-exposure) (high, CVSS 7.5, published 21 Aug 2026)
- [CVE-2026-27463: Combodo iTop version disclosure in login page logo](https://junglewise.ai/threats/cve-2026-27463-combodo-itop-version-disclosure-in-login-page-logo) (medium, CVSS 5.3, published 21 Aug 2026)
- [CVE-2026-27462: Combodo iTop user enumeration in password reset](https://junglewise.ai/threats/cve-2026-27462-combodo-itop-user-enumeration-in-password-reset) (high, CVSS 7.5, published 21 Aug 2026)
- [CVE-2025-48878: Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure…](https://junglewise.ai/threats/cve-2025-48878-combodo-itop-is-a-web-based-it-service-management-tool-in) (medium, CVSS 4.3, published 10 Nov 2025)
- [CVE-2025-48055: Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a…](https://junglewise.ai/threats/cve-2025-48055-combodo-itop-is-a-web-based-it-service-management-tool-in) (high, CVSS 8.5, published 10 Nov 2025)

## Most severe Combodo vulnerabilities

- [CVE-2026-30864: Combodo iTop reflected XSS in dashboard revert](https://junglewise.ai/threats/cve-2026-30864-combodo-itop-reflected-xss-in-dashboard-revert) (high, CVSS 8.9, published 24 Aug 2026)
- [CVE-2026-31936: Combodo iTop unauthorized access via search operation](https://junglewise.ai/threats/cve-2026-31936-combodo-itop-unauthorized-access-via-search-operation) (high, CVSS 8.8, published 21 Aug 2026)
- [CVE-2026-33240: Combodo iTop reflected XSS in foreign key search](https://junglewise.ai/threats/cve-2026-33240-combodo-itop-reflected-xss-in-foreign-key-search) (high, CVSS 8.8, published 21 Aug 2026)
- [CVE-2026-40877: Combodo iTop PHP object injection in user preferences](https://junglewise.ai/threats/cve-2026-40877-combodo-itop-php-object-injection-in-user-preferences) (high, CVSS 8.7, published 24 Aug 2026)
- [CVE-2026-34741: Combodo iTop authentication bypass in exec.php](https://junglewise.ai/threats/cve-2026-34741-combodo-itop-authentication-bypass-in-exec-php) (high, CVSS 8.6, published 21 Aug 2026)
- [CVE-2025-48055: Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a…](https://junglewise.ai/threats/cve-2025-48055-combodo-itop-is-a-web-based-it-service-management-tool-in) (high, CVSS 8.5, published 10 Nov 2025)
- [CVE-2026-31880: Combodo iTop reflected XSS in universal search](https://junglewise.ai/threats/cve-2026-31880-combodo-itop-reflected-xss-in-universal-search) (high, CVSS 8, published 21 Aug 2026)
- [CVE-2026-31803: Combodo iTop reflected XSS in tag admin](https://junglewise.ai/threats/cve-2026-31803-combodo-itop-reflected-xss-in-tag-admin) (high, CVSS 8, published 21 Aug 2026)
- [CVE-2026-30890: Combodo iTop reflected XSS in synchro import script](https://junglewise.ai/threats/cve-2026-30890-combodo-itop-reflected-xss-in-synchro-import-script) (high, CVSS 8, published 21 Aug 2026)
- [CVE-2026-30826: Combodo iTop reflected XSS in OQL query functionality](https://junglewise.ai/threats/cve-2026-30826-combodo-itop-reflected-xss-in-oql-query-functionality) (high, CVSS 8, published 21 Aug 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 1 vulnerability in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 18 | 0 | 0 |
| 24 Aug 2026 | 3 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 1 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Combodo technologies

- [Combodo iTop](https://junglewise.ai/threats/technologies/itop): 24 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Combodo vulnerabilities", https://junglewise.ai/threats/vendors/combodo, 11 November 2026.