Security Advisories
Real-world vulnerabilities discovered and responsibly disclosed by turingpoint in widely used open-source and enterprise software.
Security Research
Published Advisories
turingpoint conducts active security research on widely used open-source and enterprise software. Many of these vulnerabilities surface directly during penetration tests for our clients. The following findings were identified by us, disclosed to the vendors through coordinated disclosure, and published as CVEs once a patch became available. Security research made in Germany.
Sort by:
Product
CVE
Vulnerability
CVSS
Advisory
- ZenNotes Servernot requested`originDecisionFor` grants credentialed CORS to every loopback origin on the default bind `127.0.0.1:7878`, and `SameSite=Strict` does not separate ports; a page on another loopback port reads and writes the whole vault with the victim's session6.3 · Medium
- MrRSSnot requested`noscript` is missing from the removal list in `PrepareArticleContent`, and the `template.innerHTML` round trip in `withLazyImages` turns the raw text back into markup; a feed item executes JavaScript in the application origin after one click8.1 · High
- It's a Plannot requestedChat message parsed as a CLI option executes code on the runner host8.5 · High
- It's a Plannot requestedInvite token readable by the default role escalates a member to project owner7.1 · High
- It's a Plannot requestedPasskey enrolment with an API key survives password reset and key revocation8.1 · High
- Relaticlenot requestedAccount takeover via `X-Forwarded-Host` in the password reset link8.8 · High
- AuthgearrequestedAnonymous read of `authgear.yaml` and hook source via path traversal in `/static/`7.5 · High
- Bulwark WebmailrequestedThe WOPI editor token and the `jmap_stalwart_ctx` cookie are the same AES-256-GCM envelope under the same key; `isValidContext` checks neither the purpose tag `t: 'wopi'` nor the file scope nor `exp`, so an editor token counts as a full session7.3 · High
- Bulwark Webmailrequested`POST /api/auth/session` writes the session cookie from an unauthenticated request body with no CSRF check; a form with `enctype=\"text/plain\"` produces valid JSON, and `SameSite=Lax` does not apply because the cookie is written rather than read6.3 · Medium
- Bulwark Webmailrequested`/plugin-sandbox` is a login-free top-level document carrying `unsafe-eval` whose handler binds to the first window that posts to it without checking its origin; the supplied string reaches `new Function` in the webmail origin8.8 · High
- Bulwark Webmailrequested`encodeHeaderWord()` encodes only values holding non-ASCII characters; a CRLF smuggled into the subject inside an encoded word is copied unchanged into the read receipt and becomes real headers sent by the victim's account5.7 · Medium
- Bulwark WebmailrequestedA `cid:` link becomes a blob URL with a sender-chosen MIME type and is passed to `window.open()`; on paths whose last segment contains a dot the proxy sends no CSP, so the blob runs in the webmail origin9.3 · Critical
- Bulwark Webmailrequested`POST /api/auth/stalwart-context` and `POST /api/auth/session` issue the encrypted identity cookies for a freely chosen username; `verifyIdentity()` checks only the name in the cookie, not the credential it carries. A bypass of the fix for CVE-2026-348348.2 · High
- SEP sesamrequestedUnauthenticated remote root code execution: the `executeSql` REST endpoint (TCP 11401, no authentication by default) compiles a `RYTHM` `template` expression to Java bytecode and runs it as root10.0 · Critical
- Collax Security GatewayrequestedOS command injection with no precondition: a delegated `mailadmin` injects via the hold action `refvalue` and reaches execution as `admin`, then root9.9 · Critical
- Collax Security GatewayrequestedOS command injection: a delegated `proxyadmin` injects via the Squid rule tester `plain` fields `url`/`username` and reaches execution as `admin`, then root9.9 · Critical
- Collax Security GatewayrequestedAnonymous reflected SVG XSS: the `c` parameter of `generate-logo.cgi` reaches an active `image/svg+xml` document raw9.3 · Critical
- Collax Security GatewayrequestedAnonymous reflected XSS: `ui` and `from` are reflected without `ESCAPE=HTML` into the login page of both origins, enabling credential harvesting9.3 · Critical
- Collax Security GatewayrequestedAnonymous reflected XSS: `webaccess.cgi` serialises `%ENV` into an inline `<script>` block and does not escape the wrapping single quote9.3 · Critical
- Collax Security GatewayrequestedOS command injection: a delegated `mailadmin` overwrites the client-side queue `id` in held-mail release and reaches execution as `admin`, then root8.5 · High
Coordinated Disclosure
turingpoint follows the principle of coordinated disclosure: vulnerabilities we find are first reported confidentially to the affected vendor and only documented publicly once a patch is available. This gives users the opportunity to secure their systems before technical details become known. Our disclosure policy describes the process and how external security researchers can obtain a CVE ID through us.
This Expertise for Your Software
Our team finds critical vulnerabilities in production software before attackers do. Have your applications tested by the same specialists, with a penetration test from turingpoint.