Security Advisories
Real-world vulnerabilities discovered and responsibly disclosed by turingpoint in widely used open-source and enterprise software.
Security Research
Published Advisories
turingpoint conducts active security research on widely used open-source and enterprise software. Many of these vulnerabilities surface directly during penetration tests for our clients. The following findings were identified by us, disclosed to the vendors through coordinated disclosure, and published as CVEs once a patch became available. Security research made in Germany.
Sort by:
Product
CVE
Vulnerability
CVSS
Advisory
- ntopngnot requested`isValidHostName` permits angle brackets and quotes, and the Hosts view writes the name learned from network traffic into the DOM with `v-html`; a regression of CVE-2014-5464, still without a fix8.5 · High
- GoCDCVE-2026-68919Stored XSS via a commit message shaped as package material JSON (`materials_helper.rb` classifies by a regex on the comment text instead of the material type)7.0 · High
- ntopngCVE-2026-82412Remote code execution via OS command injection in the `scan_ports` parameter of the vulnerability-scan REST API, reachable by any authenticated account down to the lowest read-only role8.8 · High
- Adminernot requestedPath traversal in the bundled `sql-log` plugin: with no database selected `$_GET["ns"]` becomes the log path unchecked, letting any logged-in user write arbitrary `.sql` files5.4 · Medium
- seerrCVE-2026-73291Path traversal to remote code execution via the avatar proxy cache filename built from the media server's `ETag` (`path.join` collapses `../`, overwrites `/app/dist/index.js`)7.1 · High
- SaltcornrequestedThe `as_link` field view writes the stored value into an `href` with no scheme check; the js-xss filter only applies inside a tag, so an anonymously submitted `javascript:` URL executes in the administrator's session9.3 · Critical
- OpenWrtCVE-2026-62947ACL bypass and arbitrary root file read via `cgi-download` (missing path canonicalization, `fnmatch` without `FNM_PATHNAME`)4.9 · Medium
- Joplin ServerCVE-2026-59814Stored XSS via an inline-served attachment on a publicly shared note (attacker-controlled `Content-Type`, missing CSP `script-src`/`nosniff`); escalates to full admin access against a logged-in administrator7.6 · High
- OpencastCVE-2026-77614Session fixation enables account takeover via a crafted link (`JSESSIONID` is not rotated on login and an id supplied via `;jsessionid=` is adopted)8.8 · High
- OpencastCVE-2026-77615Stored XSS in the Paella player via caption cues (WebVTT/DFXP cue text reaches the DOM via `innerHTML` without escaping)8.7 · High
- LimeSurveyrequestedBlind SQL injection in the statistics output via column names in the `summary[]` POST parameter; `quoteColumnName()` does not escape backticks6.5 · Medium
- SOGorequestedStored XSS through client-side template injection in the calendar invitation card: the description text is evaluated by AngularJS instead of displayed, and the attacker needs no account9.6 · Critical
- OPNsenseCVE-2026-58390Stored XSS via OpenVPN `common_name` (RADIUS/LDAP) in the status views → code execution in the root admin session, escalating to root RCE8.0 · High
- OpenVAS Scannernot assigned`Image::from_str` filters empty segments only, so `..` from registry, image and tag reaches the unpack path; an unauthenticated scan creates directories outside the working directory as root, writes there, and on cleanup recursively deletes foreign trees9.0 · Critical
- LightdashrequestedThe metric query embeds `customDimensions[].sql` and `additionalMetrics[].sql` into the warehouse query with no permission check; the `interactive_viewer` role thereby runs arbitrary SQL without holding `manage:SqlRunner`8.8 · High
- ApostropheCMSCVE-2026-63667Arbitrary read of allow-listed-extension files via the attachment path built from the archive JSON in the `@apostrophecms/import-export` module (the `../` guard only checks tar entries, not the JSON fields)6.5 · Medium
- MalcolmCVE-2026-55676Authenticated RCE via unrestricted `.php` upload in the file-upload component (empty allowlist)8.8 · High
- CronicleCVE-2026-55562Stored XSS in the `full_name` field of the Activity Log → code execution in the admin session9.0 · Critical
- TautulliCVE-2026-45381Reflected XSS in the `/search` `query` parameter (incomplete escaping) → API key theft7.4 · High
- GraylogCVE-2026-69190Manager-to-Owner privilege escalation via the `share_request` field of `PUT /api/views/{id}` (the update path checks `view:edit` instead of ownership) → deletion of other users' dashboards6.3 · Medium