https://vulnogram.org/ Most recent CVEs assigned by SBA Research gGmbH (sba-research). https://vulnogram.org/seaview/icons/sba-research.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-16970 https://vulnogram.org/CVE-2026-16970 The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time. Medium Thu, 30 Jul 2026 09:45:24 GMT https://vulnogram.org/CVE-2026-18362 https://vulnogram.org/CVE-2026-18362 The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. Medium Network Exploitable Thu, 30 Jul 2026 09:44:32 GMT https://vulnogram.org/CVE-2026-16971 https://vulnogram.org/CVE-2026-16971 The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. Medium Network Exploitable Thu, 30 Jul 2026 09:43:51 GMT https://vulnogram.org/CVE-2026-18361 https://vulnogram.org/CVE-2026-18361 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. High Thu, 30 Jul 2026 09:42:25 GMT https://vulnogram.org/CVE-2026-18360 https://vulnogram.org/CVE-2026-18360 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. High Thu, 30 Jul 2026 09:41:18 GMT https://vulnogram.org/CVE-2026-16969 https://vulnogram.org/CVE-2026-16969 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. High Thu, 30 Jul 2026 09:40:14 GMT https://vulnogram.org/CVE-2026-13211 https://vulnogram.org/CVE-2026-13211 The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with the “Service” or “Admin” role. Medium Wed, 01 Jul 2026 15:46:25 GMT https://vulnogram.org/CVE-2025-41259 https://vulnogram.org/CVE-2025-41259 SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update. High Wed, 03 Jun 2026 11:01:59 GMT https://vulnogram.org/CVE-2025-41258 https://vulnogram.org/CVE-2025-41258 LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API. High Wed, 18 Mar 2026 11:08:19 GMT https://vulnogram.org/CVE-2025-41257 https://vulnogram.org/CVE-2025-41257 Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise. Medium Network Exploitable Wed, 04 Mar 2026 22:43:53 GMT https://vulnogram.org/CVE-2025-41255 https://vulnogram.org/CVE-2025-41255 Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberd… High Network Exploitable Wed, 25 Jun 2025 09:21:37 GMT https://vulnogram.org/CVE-2025-41256 https://vulnogram.org/CVE-2025-41256 Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak. This issue affects Cyberduck: through 9.1.6;… High Network Exploitable Wed, 25 Jun 2025 09:16:58 GMT https://vulnogram.org/CVE-2024-13919 https://vulnogram.org/CVE-2024-13919 The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page. High Network Exploitable Mon, 10 Mar 2025 10:03:01 GMT https://vulnogram.org/CVE-2024-13918 https://vulnogram.org/CVE-2024-13918 The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page. High Network Exploitable Mon, 10 Mar 2025 10:02:29 GMT https://vulnogram.org/CVE-2024-5676 https://vulnogram.org/CVE-2024-5676 The Paradox IP150 Internet Module in version 1.40.00 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of countermeasures and the use of the HTTP method `GET` to introduce changes in the system. Medium Network Exploitable Wed, 19 Jun 2024 09:47:38 GMT https://vulnogram.org/CVE-2024-5658 https://vulnogram.org/CVE-2024-5658 The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period. Medium Thu, 06 Jun 2024 10:32:07 GMT https://vulnogram.org/CVE-2024-5657 https://vulnogram.org/CVE-2024-5657 The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP. Low Network Exploitable Thu, 06 Jun 2024 10:29:40 GMT