opencats has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 7. The median CVSS is 4.3 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-862 (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.3
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Worst active — by depth score
CVE-2026-54454Critical· 9.1OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams50CVE-2026-112786Medium· 5.4OpenCATS before 0.10.0 Missing Authorization via Import Revert Action30CVE-2026-113349Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent24CVE-2026-112787Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports24CVE-2026-112785Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints24
opencats vulnerabilities
CVEs affecting opencats, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-112783Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary …
CVE-2026-112786Medium· 5.4OpenCATS before 0.10.0 Missing Authorization via Import Revert Action
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's…
CVE-2026-113349Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access…
CVE-2026-112787Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeE…
CVE-2026-112785Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editList…
CVE-2026-112784Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromA…
CVE-2026-54454Critical· 9.1OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for…