Threats affecting pkg:github/transmission/transmission

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.7	EPSS 1.2%	CVE-2026-116748Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that High8.7EPSS 1.2%2026-10-27GCVE DatabaseCVE-2026-116748 Transmission versions 4.0.0 up to but not including 4.1.3 have a permissive CORS vulnerability in the handle_request() function of rpc-server.cc. This flaw exposes the X-Transmission-Session-Id anti-CSRF token to any web origin, allowing malicious web pages to read the token from the 409 handshake response and reuse it to perform unauthorized RPC calls. These calls can lead to actions such as executing script-torrent-done, changing the download directory, or deleting torrents and data. EPSS 1.2%Report on CVE-2026-116748 Vulnerability CWE-942 #ghsa-jw4h-7968-5hj9	GCVE Database	2026-10-27
Medium	5.3	EPSS 0.3%	CVE-2026-38978transmission · HTTP Request/Response Splitting Medium5.3EPSS 0.3%2026-06-02CVE Database V5CVE-2026-38978 transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. EPSS 0.3%Vulnerability CWE-113	CVE Database V5	2026-06-02

Page 1 of 1