humhub has 3 CVEs on record between 2025 and 2026. The median CVSS is 6.1 (medium). Most affected products: files (2), calendar (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-54790Medium· 6.5Files is a module for managing files inside spaces and user profiles36CVE-2026-29052Medium· 6.1The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities34CVE-2025-54789Medium· 6.1Files is a module for managing files inside spaces and user profiles34
humhub vulnerabilities
CVEs affecting humhub, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-29052Medium· 6.1The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities
The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability …
CVE-2025-54790Medium· 6.5Files is a module for managing files inside spaces and user profiles
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized dat…
CVE-2025-54789Medium· 6.1Files is a module for managing files inside spaces and user profiles
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code exe…