xenforo xenforo

Name: xenforo xenforo
Brand: xenforo

productUS

cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

2critical9high9medium2low

updated 2026-10-28

vulnerabilities (28)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-43032US	medium4.8	0.91% (60th)	Exploit	no fix	2021-11-03	≤ 2.2.7
CVE-2026-74239US	high7.2	0.89% (59th)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73309US	critical9.1	0.69% (52nd)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73314US	high7.5	0.65% (51st)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73321US	medium6.5	0.61% (49th)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73313US	high8.1OT elevated	0.58% (48th)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73311US	high7.4OT elevated	0.50% (43rd)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73318US	low3.8OT elevated	0.49% (42nd)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73310US	medium5.9OT elevated	0.48% (42nd)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73312US	high7.4OT elevated	0.47% (41st)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73319US	medium6.1	0.41% (35th)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73317US	low2.7OT elevated	0.41% (35th)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73320US	medium6.1	0.36% (30th)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73315US	high8.6	0.36% (29th)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2026-73316US	high7.5OT elevated	0.27% (18th)	Exploit	2.3.13	2026-09-08	< 2.3.13
CVE-2024-38457US	high8.8	7.41% (94th)	—	2.2.16	2024-06-16	< 2.2.16
CVE-2024-25006US	—	1.02% (63rd)	—	2.2.14	2024-02-29	< 2.2.14
CVE-2024-38458US	high8.8	0.89% (59th)	—	2.2.16	2024-06-16	< 2.2.16
CVE-2026-35056US	—	0.67% (52nd)	—	2.3.9	2026-04-01	2 versions
CVE-2025-71279US	—	0.45% (39th)	—	2.3.7	2026-04-01	< 2.3.7
CVE-2025-71282US	—	0.34% (28th)	—	2.3.7	2026-04-01	< 2.3.7
CVE-2025-71281US	critical9.8	0.33% (26th)	—	2.3.7	2026-04-01	< 2.3.7
CVE-2025-71278US	—OT elevated	0.27% (18th)	—	2.3.5	2026-04-01	2.3.0 → 2.3.5
CVE-2026-35057US	medium5.4	0.17% (6th)	—	2.2.19	2026-04-01	2 versions
CVE-2026-35055US	—	0.15% (5th)	—	2.2.18	2026-04-01	2 versions
CVE-2024-58342US	medium6.1	0.15% (4th)	—	2.2.17	2026-04-01	2 versions
CVE-2026-35054US	medium5.4	0.14% (3rd)	—	2.3.9	2026-04-01	< 2.3.9
CVE-2025-71280US	medium5.5	0.12% (2nd)	—	2.3.7	2026-04-01	< 2.3.7

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-863Incorrect Authorization5 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-294Authentication Bypass by Capture-replay2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-209Generation of Error Message Containing Sensitive Information1 CVEs
CWE-287Improper Authentication1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE28 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan