indico vulnerabilities
CVEs whose affected-version data names the indico package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
8 CVEsRSS
CVE-2026-33046HighIndico discloses local files resulting in Remote Code Execution through LaTeX injection
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
▾ Twilightindico · indicoEPSS 0.78%via OSV
CVE-2026-28352Medium· 6.5Indico has a missing access check in the event series management API
Indico has a missing access check in the event series management API
▾ Sunlitindico · indicoEPSS 0.26%via OSV
CVE-2026-25739Medium· 5.4Indico Affected by Cross-Site-Scripting via material uploads
Indico Affected by Cross-Site-Scripting via material uploads
▾ Sunlitindico · indicoEPSS 0.17%via OSV
CVE-2026-25738MediumIndico has Server-Side Request Forgery (SSRF) in multiple places
Indico has Server-Side Request Forgery (SSRF) in multiple places
▾ Sunlitindico · indicoEPSS 0.20%via OSV
CVE-2025-59035Medium· 4.6Indico vulnerable to Cross-Site Scripting via LaTeX math code
Indico vulnerable to Cross-Site Scripting via LaTeX math code
▾ Sunlitindico · indicoEPSS 0.20%via OSV
CVE-2025-59034Medium· 4.3Indico may disclose unauthorized user details access via legacy API
Indico may disclose unauthorized user details access via legacy API
▾ Sunlitindico · indicoEPSS 0.25%via OSV
CVE-2025-53640MediumPoCIndico vulnerability allows attackers to bulk dump user details
Indico vulnerability allows attackers to bulk dump user details
▾ Twilightindico · indicoEPSS 0.60%via OSV
CVE-2024-50633None· 0.0PoCIndico Insecure Access
Indico Insecure Access
▾ Twilightindico · indicoEPSS 0.63%via OSV