Humhub

This hub aggregates every CVE we track for Humhub, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Humhub.

• CVE-2026-93769HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeoverSep 23, 2026
• CVE-2026-18430HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reasonAug 19, 2026
• CVE-2026-18756HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button renderingAug 19, 2026
• CVE-2026-18526HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmationAug 19, 2026
• CVE-2026-47657HumHub Missing Authorization on Remove All Space Members ActionJul 21, 2026
• CVE-2026-29048HumHub: XSS in Button componentMar 6, 2026
• CVE-2025-64442HumHub is vulnerable to XSS through its Meta Search component6.1Nov 7, 2025
• CVE-2024-52043User enumeration in HubHub5.3Nov 6, 2024
• CVE-2022-31133Cross site scripting in HumHub5.9Jul 7, 2022
• CVE-2017-20028HumHub privileges management5.6Jun 9, 2022
• CVE-2017-20027HumHub DOM cross site scriting4.3Jun 9, 2022
• CVE-2017-20026HumHub Reflected cross site scriting4.3Jun 9, 2022
• CVE-2022-24865Improper access control in humhub6.5Apr 20, 2022
• CVE-2021-43847Authorization Bypass in Space Invite in HumHub6.5Dec 20, 2021
• CVE-2019-11564A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index....6.1May 8, 2019