Skip to content
OpenAdvisories

Product · Best Practical Solutions

RT for Incident Response

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-105455

    Stored XSS via related ticket subject on RTIR Split and Create Incident forms

    RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RT…

    Best Practical Solutions RT for Incident Response
  • Medium 5.3
    CVE-2026-105456

    Stored XSS via HTML scrubber rule in RTIR

    RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR…

    Best Practical Solutions RT for Incident Response