RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability where an attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. This issue has been fixed in versions 5.0.10 and 6.0.3.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade request-tracker5 | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade rt5-standalone (Ubuntu Pro)Upgrade rt5-fcgi (Ubuntu Pro)Upgrade rt5-db-postgresql (Ubuntu Pro)Upgrade rt5-db-sqlite (Ubuntu Pro)Upgrade rt5-clients (Ubuntu Pro)Upgrade request-tracker5 (Ubuntu Pro)Upgrade rt5-db-mysql (Ubuntu Pro)Upgrade rt5-apache2 (Ubuntu Pro) | Jul 6, 2026 | May 21, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub