Skip to content
OpenAdvisories

Vendor

aces

13 known vulnerabilities.

Products

Loris 13
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-55146

    LORIS has incorrect access checks in issue_tracker

    LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `issue_tracker` backend…

    aces Loris
  • Medium 6.3
    CVE-2026-55147

    LORIS has incorrect access checks in API for Imaging Browser

    LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `API` for the `imaging_…

    aces Loris
  • Medium 4.3
    CVE-2026-39985

    LORIS has an open redirect field on login

    LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value …

    aces Loris
  • Medium 6.5
    CVE-2026-35403

    LORIS has potential cross-site scripting in survey_accounts module

    LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 15.10 to before 27.0.3 and 28.0.1, there is a potential for a cross-site scripting attack in th…

    aces Loris
  • Medium 6.3
    CVE-2026-35165

    LORIS has incorrect access checks in document_repository

    LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21.0.0 to before 27.0.3 and 28.0.1, while the document_repository frontend was restricting file…

    aces Loris
  • Medium 6.3
    CVE-2026-34985

    LORIS has incorrect access checks in media module

    LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 16.1.0 to before 27.0.3 and 28.0.1, While the frontend of the media module filters files that t…

    aces Loris