CVE-2026-27694

>= 6.11.1 and < 6.13.0

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notific

5.4MEDIUM

CVE-2026-27693

>= 6.11.1 and < 6.13.0

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX e

5.4MEDIUM

CVE-2026-27644

>= 6.11.1 and < 6.13.0

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position

6.5MEDIUM

CVE-2026-25649

<= 6.11.1

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users c

7.3HIGH

CVE-2026-25648

>= 6.11.1

Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can exe

8.7HIGH

CVE-2026-23521

<= 6.11.1

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users w

6.5MEDIUM

CVE-2025-68930

<= 6.11.1

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH

7.1HIGH

CVE-2024-7746

>= 2.12 and <= 6.0

Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication

9.8CRITICAL

CVE-2024-31214

>= 5.1 and <= 5.12

Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the

9.6CRITICAL

CVE-2023-50729

< 5.11

Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in

8.4HIGH

CVE-2021-21292

< 4.12

Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerabili

5.5MEDIUM

CVE-2020-5246

< 4.9

Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP

7.7HIGH

CVE-2019-5748

all versions

In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.

9.8CRITICAL

CVE-2018-1000881

<= 4.0

Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulner

9.8CRITICAL