Bestpractical Bestpractical

  1. Vendors
  2. Bestpractical

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Bestpractical product.

RSS Feeds for Bestpractical security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Bestpractical products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Bestpractical Sorted by Most Security Vulnerabilities since 2018

Bestpractical Rt17 vulnerabilities

Bestpractical Request Tracker14 vulnerabilities

Bestpractical Request Tracker Incident Response2 vulnerabilities

By the Year

In 2026 there have been 11 vulnerabilities in Bestpractical with an average score of 6.3 out of ten. Last year, in 2025 Bestpractical had 4 security vulnerabilities published. That is, 7 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.14




Year Vulnerabilities Average Score
2026 11 6.33
2025 4 6.47
2024 0 0.00
2023 3 7.50
2022 4 7.60
2021 1 7.50
2020 0 0.00
2019 1 7.50

It may take a day or so for new Bestpractical vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Bestpractical Security Vulnerabilities

CVE Date Vulnerability Products
CVE-2026-44230 Jul 20, 2026
Reflected XSS in RT 5.0.45.0.10 & 6.0.06.0.3 RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability where an attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. This issue has been fixed in versions 5.0.10 and 6.0.3.
Rt
CVE-2026-44231 Jul 20, 2026
RT REST2.0 API Info Disclosure & PrivEsc in RT <5.0.10 / <6.0.3 RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users including users with administrative privileges and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.
Rt
CVE-2026-44229 Jul 20, 2026
XSS via Inline Upload in RT 5.0.0-5.0.9 & 6.0.0-6.0.2 RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. This issue has been fixed in versions 5.0.10 and 6.0.3.
Rt
CVE-2026-44228 Jul 20, 2026
Stored XSS in RT 6.0.06.0.2 (fixed in 6.0.3) RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevant data can inject JavaScript that executes when another RT user views the affected page. This issue has been fixed in version 6.0.3.
Rt
CVE-2026-44227 Jul 20, 2026
RT 6.0.0-6.0.2 Reflected XSS via Authenticated URL RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. There are no effective workarounds. Avoid following untrusted RT URLs. This issue has been fixed in version 6.0.3.
Rt
CVE-2026-41076 May 22, 2026
Auth Bypass in RT 5.0.9-6.0.2 via LDAP/AD RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication bypass vulnerability in RT installations that use LDAP/AD for user authentication. Under certain LDAP server configurations, an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by reviewing their LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts. Upgrading RT remains the recommended fix.
Rt
CVE-2026-41075 May 22, 2026
RT SQLi Before 5.0.10 & 6.0.3 (auth.) RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by restricting RT account access to trusted users.
Rt
CVE-2026-41074 May 22, 2026
RT: CSRF in issue tracker before v6.0.3 RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user's behalf. This issue has been fixed in version 6.0.3.
Rt
CVE-2026-41073 May 22, 2026
RT <5.0.10/6.0.2: CSV/Formula Injection in Spreadsheet Export RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.
Rt
CVE-2026-6841 May 21, 2026
XSS via Page Param in Request Tracker 5.0.4-5.0.9 / 6.0.0-6.0.2 Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victims browser. This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2.
Request Tracker
Built by Foundeo Inc., with data from the National Vulnerability Database (NVD). Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.