Skip to content

Vendor

GBIF vulnerabilities

4 published CVES affecting GBIF, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
2
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of GBIF alerts

Products

Latest GBIF CVEs

Newest publication first

  1. CVE-2026-71881 Cross-site scripting in Integrated Publishing Toolkit

    Published
    MediumCVSS 4.8 EPSS 0.42%

    Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting

  3. CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

    Published
    CriticalCVSS 9.1 EPSS 0.86%

    Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

  4. CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

    Published
    CriticalCVSS 9.2 EPSS 0.86%

    Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.