Aces vulnerabilities
We track 4 vulnerabilities in Aces products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on April 8, 2026.
Latest Aces vulnerabilities
- 8.6 High severity
Loris: Files or Directories Accessible to External Parties
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler
- 7.5 High severity
Loris: Files or Directories Accessible to External Parties
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to tra
- 7.5 High severity
Loris: Improper Neutralization of Special Elements used in an SQL Command
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, a SQL injection has been identified in some code sections for the MRI fee
- 8.8 High severity
Loris: Improper Limitation of a Pathname to a Restricted Directory
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with sufficient privileges can ex