BookStack

Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.

1. Remote Code Execution Through Image Uploads in BookStackCVE-2020-5256BookStackApp · CVSS 7.9 · 2.0% likely

   CWE-95

2. Cross-Site Scripting in BookStackCVE-2020-26210BookStackApp · CVSS 7.7 · 1.2% likely

   CWE-79

3. Cross-Site Scripting in BookStackCVE-2020-26211BookStackApp · CVSS 7.7 · 1.1% likely

   CWE-79

4. BookStack before 26.05.4 Remote Code Execution via Book CoverCVE-2026-82450bookstackapp · CVSS 8.8 · 1.0% likely

   CWE-434

5. Server Side Request Forgery in BookStackCVE-2020-26260BookStackApp · CVSS 6.4 · 0.8% likely

   CWE-74

6. Cross-site Scripting in BookStackCVE-2020-11055BookStackApp · CVSS 6.3 · 0.8% likely

   CWE-79

7. BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code.CVE-2017-1000462Bookstackapp · 0.8% likely

   CWE-79

8. BookStack before 26.05.4 Stored XSS via Drawing UploadCVE-2026-84695bookstackapp · CVSS 8.7 · 0.5% likely

   CWE-79

9. BookStack < 26.05.5 Authentication Bypass via Social Login Provider ConfusionCVE-2026-89022bookstackapp · CVSS 7.4 · 0.5% likely

   CWE-290

10. BookStack < 26.05.4 Broken Access Control via Image Gallery APICVE-2026-67204BookStackApp · CVSS 5.4 · 0.4% likely

    CWE-863

11. BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access controlCVE-2026-5484BookStackApp · CVSS 5.3 · 0.3% likely

    CWE-266

12. BookStack before 26.09.3 Incorrect Authorization via Image and Drawio EndpointsCVE-2026-126811BookStackApp · CVSS 5.4 · 0.3% likely

    CWE-863

13. BookStack before 26.09.3 Broken Access Control via ImageControllerCVE-2026-125870bookstackapp · CVSS 4.2 · 0.2% likely

    CWE-863

14. BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft PagesCVE-2026-116020BookStackApp · CVSS 5.4 · 0.2% likely

    CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.