GCVE - cpe:2.3:a:transmissionbt:transmission:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:transmissionbt:transmission:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Transmissionbt (`be91406d-87f4-5c5c-88fb-ead9d032a2b7`)
Product	Transmission (`87fab0ba-0180-5951-90a5-13e8647c07be`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/alfredd/transmission`	purl2cpe	2026-06-01 10:13:04.058162
`pkg:deb/debian/transmission`	purl2cpe	2026-06-01 10:13:04.058165
`pkg:deb/ubuntu/transmission`	purl2cpe	2026-06-01 10:13:04.058168
`pkg:github/transmission/transmission`	purl2cpe	2026-06-01 10:13:04.058171
`pkg:rpm/fedora/transmission`	purl2cpe	2026-06-01 10:13:04.058173
`pkg:rpm/opensuse/transmission`	purl2cpe	2026-06-01 10:13:04.058176
`pkg:sourceforge/transmission-daemon-cfp`	purl2cpe	2026-06-01 10:13:04.058179

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-116748`	vulnerable	2026-11-03 10:15:22.036070	Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token HIGH (8.8) Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion. Published: 2026-10-26T21:52:45.799Z Updated: 2026-10-31T02:02:38.641Z Open on db.gcve.eu Reference links https://github.com/transmission/transmission/pull/8938 https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e https://github.com/transmission/transmission https://github.com/transmission/transmission/releases/tag/4.1.3 https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-5702`	vulnerable	2026-06-08 05:11:51.625806	Details available Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack. Published: 2018-01-15T16:00:00.000Z Updated: 2024-08-05T05:40:51.206Z Open on db.gcve.eu Reference links https://bugs.chromium.org/p/project-zero/issues/detail?id=1447 https://www.exploit-db.com/exploits/43665/ https://www.debian.org/security/2018/dsa-4087 https://github.com/transmission/transmission/pull/468 https://security.gentoo.org/glsa/201806-07	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-10756`	vulnerable	2026-06-08 05:10:37.069914	Details available Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file. Published: 2020-05-15T15:56:21.000Z Updated: 2024-08-05T07:46:46.883Z Open on db.gcve.eu Reference links https://github.com/transmission/transmission/commit/2123adf8e5e1c2b48791f9d22fc8c747e974180e https://tomrichards.net/2020/05/cve-2018-10756-transmission/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVAG2HNKNRLWOACFN5F2ANJD2SQ53WI7/ https://lists.debian.org/debian-lts-announce/2020/05/msg00022.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CD3GLZ5URIK74RCGLSH72IVLDIJJMLQC/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4909`	vulnerable	2026-06-08 05:05:46.343209	Details available Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write. Published: 2014-07-29T14:00:00.000Z Updated: 2024-08-06T11:27:36.988Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135539.html https://trac.transmissionbt.com/wiki/Changes#version-2.84 http://www.openwall.com/lists/oss-security/2014/07/10/4 http://www.securityfocus.com/bid/68487 https://bugs.gentoo.org/show_bug.cgi?id=516822	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6129`	vulnerable	2026-06-08 05:02:59.601697	Details available Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets." Published: 2013-04-03T00:00:00.000Z Updated: 2024-09-16T22:50:21.566Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-updates/2013-03/msg00064.html https://trac.transmissionbt.com/ticket/5002 http://www.ubuntu.com/usn/USN-1747-1 https://bugzilla.redhat.com/show_bug.cgi?id=909934 http://www.openwall.com/lists/oss-security/2013/02/13/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4037`	vulnerable	2026-06-08 05:02:15.674491	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0749`	vulnerable	2026-06-08 04:52:04.329940	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0748`	vulnerable	2026-06-08 04:52:04.327264	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Transmission

Notes

PURL mappings

Vulnerability references

Contribute