Combodo

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Combodo product.

RSS Feeds for Combodo security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Combodo products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Combodo Sorted by Most Security Vulnerabilities since 2018

Combodo Itop100 vulnerabilities

Combodo Teemip1 vulnerability

By the Year

In 2026 there have been 21 vulnerabilities in Combodo with an average score of 7.4 out of ten. Last year, in 2025 Combodo had 16 security vulnerabilities published. That is, 5 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.24

Year	Vulnerabilities	Average Score
2026	21	7.42
2025	16	7.67
2024	25	6.51
2023	6	7.12
2022	8	6.51
2021	11	6.65
2020	12	7.17
2019	1	7.20
2018	1	0.00

It may take a day or so for new Combodo vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Combodo Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-40877	Aug 24, 2026	iTop PHP Object Injection RCE before 3.2.3 (fixed 3.2.3) Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.	Itop
CVE-2026-30864	Aug 24, 2026	Reflected XSS via dashboard revert in Combodo iTop pre3.2.3 Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.	Itop
CVE-2026-39975	Aug 24, 2026	Combodo iTop <3.2.3 Unauth Delete .readonly File -> Code Exec Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.	Itop
CVE-2026-34949	Aug 21, 2026	Combodo iTop <=3.2.3 Unauth Delete .readonly File Deny Write Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.	Itop
CVE-2026-34948	Aug 21, 2026	Combodo iTop OQL SELECT Silo Bypass (3.2.3) Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.	Itop
CVE-2026-34836	Aug 21, 2026	Combodo iTop <3.2.3: Improper Access in ajax.render.php & ajax.document.php Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.	Itop
CVE-2026-34741	Aug 21, 2026	iTop auth bypass before 3.2.3 allows PHP exec via env-production Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.	Itop
CVE-2026-33333	Aug 21, 2026	Combodo iTop <=3.2.3 Sensitive Info Disclosure via Error Messages Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.	Itop
CVE-2026-33240	Aug 21, 2026	XSS in iTop FK Search Criteria API (before 3.2.3, fixed 3.2.3) Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.	Itop
CVE-2026-33047	Aug 21, 2026	Combodo iTop <3.2.3 Object Lock Bypass (Write Permissions) Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.	Itop