Agora Project vulnerabilities and CVEs

Known vulnerabilities affecting Agora Project, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

21 vulnerabilities tracked.

9.3 Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into… CVE-2026-63146 13 Oct 2026
9.1 Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side,… CVE-2026-63160 13 Oct 2026
9.1 Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to… CVE-2026-63159 13 Oct 2026
9.1 Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored… CVE-2026-63158 13 Oct 2026
9.1 Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default… CVE-2026-63149 13 Oct 2026
8.7 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows… CVE-2026-63163 13 Oct 2026
8.7 Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the… CVE-2026-63162 13 Oct 2026
8.7 Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate… CVE-2026-63154 13 Oct 2026
8.6 Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated… CVE-2026-63161 13 Oct 2026
8.6 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users… CVE-2026-63174 13 Oct 2026
8.6 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated… CVE-2026-63153 13 Oct 2026
8.6 Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject… CVE-2026-63165 13 Oct 2026
8.6 Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject… CVE-2026-63152 13 Oct 2026
7.1 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to… CVE-2026-63172 13 Oct 2026
5.3 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post… CVE-2026-63169 13 Oct 2026
5.1 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject… CVE-2026-63171 13 Oct 2026
5.1 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist… CVE-2026-63168 13 Oct 2026
5.1 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject… CVE-2026-63157 13 Oct 2026
5.1 Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to… CVE-2026-63156 13 Oct 2026
5.1 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject… CVE-2026-63148 13 Oct 2026
5.1 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject… CVE-2026-63147 13 Oct 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Agora Project is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other products tracked here