https://vulnogram.org/ Most recent CVEs assigned by Black Lantern Security (blsops). https://vulnogram.org/seaview/icons/blsops.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-79957 https://vulnogram.org/CVE-2026-79957 ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (… High Wed, 14 Oct 2026 18:01:51 GMT https://vulnogram.org/CVE-2026-14967 https://vulnogram.org/CVE-2026-14967 BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. T… Low Network Exploitable Wed, 08 Jul 2026 15:03:50 GMT https://vulnogram.org/CVE-2026-14966 https://vulnogram.org/CVE-2026-14966 BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip… Low Network Exploitable Wed, 08 Jul 2026 15:03:47 GMT https://vulnogram.org/CVE-2026-12568 https://vulnogram.org/CVE-2026-12568 The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the… Medium Network Exploitable Wed, 17 Jun 2026 21:53:47 GMT https://vulnogram.org/CVE-2026-12567 https://vulnogram.org/CVE-2026-12567 The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data… Low Wed, 17 Jun 2026 21:51:35 GMT https://vulnogram.org/CVE-2026-12566 https://vulnogram.org/CVE-2026-12566 The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify t… Low Network Exploitable Wed, 17 Jun 2026 21:48:57 GMT https://vulnogram.org/CVE-2026-12565 https://vulnogram.org/CVE-2026-12565 The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-speci… Medium Network Exploitable Wed, 17 Jun 2026 21:45:48 GMT https://vulnogram.org/CVE-2026-10880 https://vulnogram.org/CVE-2026-10880 OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log… Critical Network Exploitable Thu, 04 Jun 2026 17:19:33 GMT https://vulnogram.org/CVE-2026-2103 https://vulnogram.org/CVE-2026-2103 Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection strings, and API keys. The encryption keys are identical across all installations. An attacker with access to th… High Fri, 06 Feb 2026 16:22:28 GMT https://vulnogram.org/CVE-2025-12463 https://vulnogram.org/CVE-2025-12463 An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi` script. This has been confirmed on the EFD-2130 camera running firmware version 1.12.0.19. Critical Network Exploitable Mon, 03 Nov 2025 16:45:39 GMT https://vulnogram.org/CVE-2025-10284 https://vulnogram.org/CVE-2025-10284 BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution. Critical Network Exploitable Thu, 09 Oct 2025 15:46:14 GMT https://vulnogram.org/CVE-2025-10283 https://vulnogram.org/CVE-2025-10283 BBOT's gitdumper module could be abused to execute commands through a malicious git repository. Critical Network Exploitable Thu, 09 Oct 2025 15:46:12 GMT https://vulnogram.org/CVE-2025-10282 https://vulnogram.org/CVE-2025-10282 BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL. Medium Network Exploitable Thu, 09 Oct 2025 15:46:10 GMT https://vulnogram.org/CVE-2025-10281 https://vulnogram.org/CVE-2025-10281 BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL. Medium Network Exploitable Thu, 09 Oct 2025 15:45:56 GMT https://vulnogram.org/CVE-2025-10183 https://vulnogram.org/CVE-2025-10183 A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of Dec… Critical Network Exploitable Tue, 09 Sep 2025 14:50:22 GMT https://vulnogram.org/CVE-2025-6002 https://vulnogram.org/CVE-2025-6002 An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary extensions, including executable or malicious files, potentially leading to remote code e… High Wed, 11 Jun 2025 16:26:47 GMT https://vulnogram.org/CVE-2025-6001 https://vulnogram.org/CVE-2025-6001 A Cross-Site Request Forgery (CSRF) vulnerability exists in the product image upload function of VirtueMart that bypasses the CSRF protection token. An attacker is able to craft a special CSRF request which will allow unrestricted file upload into th… High Network Exploitable Wed, 11 Jun 2025 16:26:25 GMT https://vulnogram.org/CVE-2025-1888 https://vulnogram.org/CVE-2025-1888 The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting (XSS). An authenticated user can access the slides within a project and injecting malicious JavaScript into the "memo" field. The memo f… Medium Fri, 14 Mar 2025 16:11:24 GMT https://vulnogram.org/CVE-2023-3434 https://vulnogram.org/CVE-2023-3434 Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami (version 20222284) on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenge… Medium Fri, 14 Jul 2023 12:29:34 GMT https://vulnogram.org/CVE-2023-3433 https://vulnogram.org/CVE-2023-3433 The "nickname" field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters into the field. When present, these special characters, make it so the application cannot create the signature f… Medium Fri, 14 Jul 2023 12:28:53 GMT