CyberSecBulletin

traPtitech vulnerabilities

We track 2 vulnerabilities in traPtitech products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.

2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score

Latest traPtitech vulnerabilities

  • 7.3 High severity

    traQ: Incorrect Authorization

    CVE-2026-63198traPtitech

    traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all sco

  • 7.3 High severity

    traQ: Improper Neutralization of Input During Web Page Generation

    CVE-2026-63197traPtitech

    traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An a