Leantime
Security Risk Profile
54
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 14 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from March 31, 2020 to present
14
Total CVEs
7
Critical+High
0
Exploited
7
Unpatched
Threat Assessment
Avg CVSS
6.5
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
7
Critical/High
Risk Level
54/100
medium
🆕 2Fresh (<7d)📈 5 in Last 30 Days
Severity Distribution
Critical
0High
7Medium
5Low
2Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
2Age Distribution
Common Weaknesses (CWE)
1
XSS
4
2
CSRF
2
3
Code Injection
2
4
SQL Injection
2
5
SSRF
1
Most Affected Products
1. Leantime Leantime24
2. Leantime Leantime API1
3. composer/leantime/leantime1
Recent Vulnerabilities
See more →CVE-2026-54418
CVSS 8.1high
Leantime: Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass
8/5/2026🔧 No Patch
CVE-2026-66416
CVSS 8.6high
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
7/30/2026🔧 No Patch
CVE-2026-66412
CVSS 7.1high
Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC
7/27/2026🔧 No Patch
CVE-2026-15510
CVSS 2.1low
Leantime API saveSetting improper authorization
7/12/2026🔧 No Patch
CVE-2026-15509
CVSS 2.1low
Leantime JSON-RPC Endpoint addUser improper authorization
7/12/2026🔧 No Patch
CVE-2025-28254
CVSS 6.5EPSS 0%medium
2/21/2025
CVE-2024-27476
CVSS 4.7medium
4/10/2024🔧 No Patch
CVE-2024-27474
CVSS 8.8high
4/10/2024🔧 No Patch
CVE-2024-27477
CVSS 6.1medium
4/10/2024🔧 No Patch
CVE-2024-27705
CVSS 7.6high
4/3/2024🔧 No Patch
Monitor Leantime in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.