Skip to content

PatchFirst · Latest vulnerabilities

transmission vulnerabilities

Vulnerability published for transmission in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 3

CVE-2026-116748
High · CVSS 8.7EPSS 1.25%Public exploitNo fix published
Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
transmission Operating systems
Published October 26, 2026Updated October 31, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-38978
Medium · CVSS 5.3EPSS 0.3%No fix published
CVE-2026-38978
transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.
transmission Operating systems
Published June 2, 2026Updated June 5, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2018-10756
High · CVSS 7.8EPSS 2.7%No fix published
CVE-2018-10756
Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file.
transmission Operating systems
Published May 15, 2020Updated August 5, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →