indico has 8 CVEs on record between 2025 and 2026. The median CVSS is 4.6 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.6
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Products
- indico 8
Worst active — by depth score
CVE-2026-33046HighIndico discloses local files resulting in Remote Code Execution through LaTeX injection 41CVE-2025-53640MediumIndico vulnerability allows attackers to bulk dump user details40CVE-2026-28352Medium· 6.5Indico has a missing access check in the event series management API36CVE-2026-25739Medium· 5.4Indico Affected by Cross-Site-Scripting via material uploads30CVE-2026-25738MediumIndico has Server-Side Request Forgery (SSRF) in multiple places28
indico vulnerabilities
CVEs affecting indico, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-33046HighIndico discloses local files resulting in Remote Code Execution through LaTeX injection
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
CVE-2026-28352Medium· 6.5Indico has a missing access check in the event series management API
Indico has a missing access check in the event series management API
CVE-2026-25739Medium· 5.4Indico Affected by Cross-Site-Scripting via material uploads
Indico Affected by Cross-Site-Scripting via material uploads
CVE-2026-25738MediumIndico has Server-Side Request Forgery (SSRF) in multiple places
Indico has Server-Side Request Forgery (SSRF) in multiple places
CVE-2025-59035Medium· 4.6Indico vulnerable to Cross-Site Scripting via LaTeX math code
Indico vulnerable to Cross-Site Scripting via LaTeX math code
CVE-2025-59034Medium· 4.3Indico may disclose unauthorized user details access via legacy API
Indico may disclose unauthorized user details access via legacy API
CVE-2025-53640MediumPoCIndico vulnerability allows attackers to bulk dump user details
Indico vulnerability allows attackers to bulk dump user details
CVE-2024-50633None· 0.0PoCIndico Insecure Access
Indico Insecure Access