Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Kovah
Linkace

Kovah LinkAce Vulnerabilities: CVEs, CISA KEV & Security Advisories

18 CVEs

Kovah LinkAce Vulnerabilities

CVE security advisories and vulnerability history for LinkAce by Kovah.

18

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

16

Public exploits

With known exploit

7.0

Avg CVSS

2024–2026

Last updated May 28, 2026

Overview

Kovah LinkAce has 18 published CVE records since 2024, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 16 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Kovah LinkAce, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Kovah LinkAce's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High13

Medium4

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Kovah LinkAce's CVEs are currently listed in CISA's KEV catalog.

Public exploits

16

16 of Kovah LinkAce's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Kovah LinkAce version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

Fixed in

88cea68e95cbf5d950c232baae305883fede0cc64 CVEs
536632067f338f18a56941dc1483e09004f2730d2 CVEs
9446ac70010f02abcae95ba87b541ea0045790cd2 CVEs
2b141a1825f05232cb7e514f7b8f291b0c391abc1 CVE
38261c185dfc10096886de9630e15d2ab5495f051 CVE
4e0b822163ccefc2640c283ae969a39e673a06191 CVE
58b38b41d90356b0f41f240d4b3b571c891d000b1 CVE

Find a version

18 CVEs

Sort

LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes
CVE-2026-45342
Public exploit
CWE-639
High · CVSS 7.1
EPSS 0.0% (14th pct)2026-05-28
LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session Hijacking
CVE-2026-45343
Public exploit
CWE-79
High · CVSS 8.5
EPSS 0.1% (27th pct)2026-05-28
LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances
CVE-2026-45344
Public exploit
CWE-74
High · CVSS 8.1
EPSS 0.2% (43th pct)2026-05-28
LinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover
CVE-2026-40905CWE-601
High · CVSS 8.1
EPSS 0.0% (11th pct)2026-04-21
LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection
CVE-2026-35516
Public exploit
Patch
CWE-918
Medium · CVSS 5.0
EPSS 0.0% (2th pct)2026-04-07
LinkAce discloses private notesto unauthorized authenticated users via the web link detail page
CVE-2026-33954
Public exploit
Patch
CWE-285
Medium · CVSS 6.5
EPSS 0.0% (14th pct)2026-03-27
LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce
CVE-2026-33953
Public exploit
Patch
CWE-918
High · CVSS 8.5
EPSS 0.0% (14th pct)2026-03-27
LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy()
CVE-2026-30954CWE-639
Medium · CVSS 5.3
EPSS 0.0% (15th pct)2026-03-10
LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest
CVE-2026-30953
Public exploit
CWE-918
High · CVSS 7.7
EPSS 0.0% (15th pct)2026-03-10
LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description
CVE-2026-27458
Public exploit
Patch
CWE-80
High · CVSS 8.7
EPSS 0.0% (4th pct)2026-02-21
LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature
CVE-2025-62722
Public exploit
Patch
CWE-79
High · CVSS 8.7
EPSS 0.0% (9th pct)2025-11-04
LinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and Tags
CVE-2025-62721
Public exploit
Patch
CWE-284
High · CVSS 7.1
EPSS 0.0% (15th pct)2025-11-04
LinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private Links
CVE-2025-62720
Public exploit
Patch
CWE-284
High · CVSS 7.1
EPSS 0.0% (15th pct)2025-11-04
LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality
CVE-2025-62719
Public exploit
Patch
CWE-918
Low · CVSS 2.3
EPSS 0.0% (9th pct)2025-11-04
LinkAce Vulnerable to Stored XSS on the Audit Page
CVE-2025-59424
Public exploit
Patch
CWE-79
High · CVSS 7.3
EPSS 0.1% (23th pct)2025-09-18
LinkAce has a Stored One Click XSS vulnerability
CVE-2025-53838
Public exploit
Patch
CWE-79
High · CVSS 8.4
EPSS 0.1% (25th pct)2025-09-08
High vulnerability · 2024-12-27
CVE-2024-56508
Public exploit
Patch
CWE-434
High · CVSS 7.6
EPSS 0.5% (66th pct)2024-12-27
Medium vulnerability · 2024-12-27
CVE-2024-56507
Public exploit
Patch
CWE-79
Medium · CVSS 4.6
EPSS 1.3% (80th pct)2024-12-27

Common weakness types

The CWE weakness categories most often found in Kovah LinkAce CVEs. Follow any weakness for its full explanation.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-918Server-Side Request Forgery (SSRF)4 CVEs
CWE-639Authorization Bypass Through User-Controlled Key2 CVEs
CWE-284Improper Access Control2 CVEs
CWE-285Improper Authorization1 CVE
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1 CVE
CWE-434Unrestricted Upload of File with Dangerous Type1 CVE
CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)1 CVE

Disclosure activity by year

How many Kovah LinkAce CVEs were published each year.

2024

2

2025

6

2026

10

Other Kovah products

Browse vulnerabilities for other products by Kovah.

All Kovah vulnerabilities

Frequently asked questions

Common questions about Kovah LinkAce vulnerabilities.

How many CVEs does Kovah LinkAce have?

Kovah LinkAce has 18 published CVE records since 2024.

How many Kovah LinkAce CVEs are in CISA KEV?

None of Kovah LinkAce's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for Kovah LinkAce vulnerabilities?

Yes — 16 of Kovah LinkAce's CVEs have a known public exploit.

Which versions of Kovah LinkAce are affected?

128 distinct Kovah LinkAce versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Kovah LinkAce CVEs?

Kovah LinkAce's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-284 (Improper Access Control).

What is the average severity of Kovah LinkAce CVEs?

The average CVSS base score across Kovah LinkAce's scored CVEs is 7.0.

References

All Kovah vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Kovah LinkAce vulnerabilities

Monitor new Kovah LinkAce vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References