Security Advisories
Real-world vulnerabilities discovered and responsibly disclosed by turingpoint in widely used open-source and enterprise software.
Security Research
Published Advisories
turingpoint conducts active security research on widely used open-source and enterprise software. Many of these vulnerabilities surface directly during penetration tests for our clients. The following findings were identified by us, disclosed to the vendors through coordinated disclosure, and published as CVEs once a patch became available. Security research made in Germany.
Sort by:
Product
CVE
Vulnerability
CVSS
Advisory
- Collax Security GatewayrequestedCSRF on `rrd2csv.cgi` (`eval "require $plugin"`, no CSRF token, no SameSite) reaches code execution as `admin` and root via setuid `suwrap`8.3 · High
- Collax Security GatewayrequestedStored XSS: an unauthenticated SMTP sender sets an envelope sender the held-mail queue `Html` cell renderer writes as innerHTML8.0 · High
- Collax Security GatewayrequestedStored XSS: a layer 2 neighbour sends an LLDP frame whose typeless `<display>` field renders as raw innerHTML in the qooxdoo rich label7.4 · High
- Collax Security GatewayrequestedAnonymous deletion of the 2FA token store via path traversal in the logout cookie (`->new(sprintf)` instead of `->child`), plus an existence oracle for arbitrary paths7.3 · High
- TeableCVE-2026-104100Path traversal in the `hash` parameter of the attachment presign API: a self-registered account writes and overwrites arbitrary files in the container as root8.8 · High
- Zammadnot requestedThe public GraphQL mutation `userSignup` accepts arbitrary user columns from `objectAttributeValues`; an anonymous attacker sets `verified`, `organization_id` and `organization_ids` and reads the tickets of foreign organizations9.3 · Critical
- Zammadnot requestedA customer sets `preferences.links` and `preferences.security` when creating an article, which the default ticket view renders raw; opening the ticket runs JavaScript in the agent's session8.5 · High
- Zammadnot requested`CommonSelect.vue` escapes the autocomplete label only when it contains the search term, and `CommonSelectItem.vue` renders it with `v-html`; an anonymously registered first name runs JavaScript in the agent's browser on a search by email8.6 · High
- tinerequested`QuickLookHTMLPanel` embeds a stored `text/html` file in a same-origin frame with no `sandbox`; the inline path requires only `GRANT_READ` and sends neither `nosniff` nor a CSP, so the script reads the victim's `jsonKey`8.0 · High
- tinerequestedThe export takes its template from `options.template` and compiles it in a Twig environment with no `SandboxExtension`; through the string-callable pattern in Twig 2 the expression reaches `system()` as the application user9.9 · Critical
- SOGorequestedIncomplete fix from 5.12.10: location, organizer, reply comment and two attribute values of the same invitation card keep executing code in the webmail session9.6 · Critical
- Feathernot requestedArbitrary file write via the unconfirmed `feather://install/` deep link: the unchecked Zip library lets `../../` entries overwrite `Documents/` and `Library/`Moderate
- AusweisAppCVE-2026-90848Reflected XSS via PAOS errors: a malicious eID server's `ResultMessage` reaches the local activation service's HTML error page unescaped and executes JavaScript in the origin `http://127.0.0.1:24727`5.3 · Medium
- WordPress for Androidnot requestedThe app's own `DISABLE_NOTIFICATIONS` permission has no `protectionLevel` and falls back to `normal`; any app installed afterwards receives it without a prompt and switches the app's notifications off through the exported `JetpackAppInstallReceiver`5.1 · Medium
- Mastodon iOSrequestedOAuth bearer token of the signed-in account is sent to an attacker-controlled host as soon as the "Open in Mastodon" share action fails to resolve an ordinary web page as a Mastodon item7.1 · High
- Gardener Dashboardrequested`GET /auth/callback` reads state and PKCE verifier only inside `if (cookie in req.cookies)`; when the cookie is absent the check is dropped, and oauth4webapi reads the undefined state as expect-no-state5.4 · Medium
- VoidAuthrequested`POST /api/interaction/totp` keeps no per-account failure counter, and the only rate limit hangs on `req.ip`, which under `trust proxy` equals the self-supplied `X-Forwarded-For`; the second factor therefore falls unthrottled6.8 · Medium
- Rapid7 VelociraptorCVE-2026-85737Low-privilege analyst reads arbitrary server files via ungated `sql()` VQL plugin (no permission check, CA private key disclosed)6.5 · Medium
- Easy!Appointmentsnot requestedThe password reset link is built from the `Host` header; an anonymous attacker points it to their server and takes over the administrator account after the victim clicks it7.5 · High
- WazuhCVE-2026-74034An anonymously enrolled agent injects an `upgrade_custom` command into the manager's upgrade socket and has any file on the host shipped back as root (no origin check, no path jail)7.5 · High