Browse CVEs

HIGH 8.8 CVE-2025-26378 A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 8.8 CVE-2025-26371 A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 8.8 CVE-2025-26375 A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 8.1 CVE-2025-26372 A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 8.1 CVE-2025-26377 A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-… Maxtime after 2.11.0 Fix from $1,9502025-02-12 MEDIUM 6.5 CVE-2025-26373 A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an aut… Maxtime after 2.11.0 Fix from $1,6002025-02-12 MEDIUM 6.5 CVE-2025-26376 A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-… Maxtime after 2.11.0 Fix from $1,6002025-02-12 HIGH 8.8 CVE-2025-26369 A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 8.1 CVE-2025-26368 A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 7.5 CVE-2025-26364 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 7.5 CVE-2025-26365 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 7.5 CVE-2025-26366 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 7.1 CVE-2025-26370 A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated… Maxtime after 2.11.0 Fix from $1,9502025-02-12 CRITICAL 9.8 CVE-2025-26359 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 all… Maxtime after 2.11.0 Fix from $2,3002025-02-12 CRITICAL 9.1 CVE-2025-26361 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows… Maxtime after 2.11.0 Fix from $2,3002025-02-12 HIGH 7.5 CVE-2025-26362 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 7.5 CVE-2025-26363 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 7.2 CVE-2025-26356 A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an … Maxtime after 2.11.0 Fix from $1,9502025-02-12 MEDIUM 5.5 CVE-2025-26358 A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentic… Maxtime after 2.11.0 Fix from $1,6002025-02-12 MEDIUM 5.3 CVE-2025-26360 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 … Maxtime after 2.11.0 Fix from $1,6002025-02-12 HIGH 8.8 CVE-2025-26350 A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allow… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 7.2 CVE-2025-26354 A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authe… Maxtime after 2.11.0 Fix from $1,9502025-02-12 MEDIUM 6.5 CVE-2025-26352 A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote at… Maxtime after 2.11.0 Fix from $1,6002025-02-12 MEDIUM 6.5 CVE-2025-26355 A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote … Maxtime after 2.11.0 Fix from $1,6002025-02-12 CRITICAL 9.8 CVE-2025-26344 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 a… Maxtime after 2.11.0 Fix from $2,3002025-02-12 CRITICAL 9.8 CVE-2025-26345 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows … Maxtime after 2.11.0 Fix from $2,3002025-02-12 CRITICAL 9.8 CVE-2025-26347 A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows … Maxtime after 2.11.0 Fix from $2,3002025-02-12 HIGH 8.1 CVE-2025-26343 A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 7.6 CVE-2025-26346 A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpo… Maxtime after 2.11.0 Fix from $1,9502025-02-12 HIGH 7.6 CVE-2025-26348 A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) … Maxtime after 2.11.0 Fix from $1,9502025-02-12