D
Vendor security profile
dolibarr
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs35
Critical2
CISA KEV0
Public exploit22
Patch rate%71
Avg. CVSS7.4
12-month vulnerability rate
0
0
1
0
1
4
2
0
0
18
2
1
CVE KEV
CVE severity distribution
35toplam CVE
Critical2 (6%)
High24 (69%)
Medium9 (26%)
Patch and exploitation view
%71
Verified patch
%0
CISA KEV
%63
Public exploit
25Patch available
0Partial
0Workaround
0Vendor: no patch
10Unknown
Latest vulnerabilities
5.3
CVE-2026-107706
Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php
D
Patch verifiedEPSS %0
8.7
CVE-2026-89013
Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
D
Patch verifiedEPSS %2
7.1
CVE-2026-89012
Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter
D
Patch verifiedEPSS %0
5.3
CVE-2026-82633
Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint
D
Patch verifiedEPSS %0
8.8
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
D
Patch verifiedEPSS %1
7.1
CVE-2026-81729
Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
D
Patch verifiedEPSS %0
8.6
CVE-2026-81728
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
D
Patch verifiedEPSS %0
5.3
CVE-2026-77923
Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action
D
Patch verifiedEPSS %0
7.1
CVE-2026-71511
Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints
D
Patch verifiedEPSS %0
7.1
CVE-2026-71510
Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter
D
Patch verifiedEPSS %0