Security Advisories
Real-world vulnerabilities discovered and responsibly disclosed by turingpoint in widely used open-source and enterprise software.
Security Research
Published Advisories
turingpoint conducts active security research on widely used open-source and enterprise software. Many of these vulnerabilities surface directly during penetration tests for our clients. The following findings were identified by us, disclosed to the vendors through coordinated disclosure, and published as CVEs once a patch became available. Security research made in Germany.
Sort by:
Product
CVE
Vulnerability
CVSS
Advisory
- SurrealDBnot requestedAuthenticated path traversal via an analyzer `mapper` filter (arbitrary file read)7.7 · High
- Kanidmnot requestedAnonymous stack-overflow crash via deeply nested LDAP filter on LDAPS7.5 · High
- HeyFormnot requestedStored XSS in the form renderer: a `javascript:` URL with an inserted tab passes both server and client sanitizers and runs in the workspace owner's same-origin context8.7 · High
- SemaphoreCVE-2026-73293Privilege escalation from `manager` to `owner` via a custom-role slug collision (resolver ignores the project id, `ValidateRole` has no blocklist and no permission ceiling)8.8 · High
- UnleashCVE-2026-63462Unauthenticated denial of service via deeply nested JSON to OpenAPI-validated endpoints (unguarded `JSON.stringify` → `RangeError`, process crash)7.5 · High
- Portainerrequested`IsValidStackFile` rejects bind mounts from non-administrators in `volumes` but never checks `configs` and `secrets`, whose `file` names any host path; through the Docker socket this becomes control of the host9.4 · Critical
- Label Studionot requestedThe editor filter forbids event attributes through a denylist rather than an allowlist; `onfocusin` and the SMIL elements `animate` and `set` are missing from it, so task data runs script in the project lead's session9.0 · Critical
- Apache AirflowCVE-2026-58076Remote code execution in the Scheduler and the API server via an unchecked `import_string()` on the class name of an exception node in Dag deserialization (`executor_config` reaches the branch)8.8 · High
- Part-DBCVE-2026-54630Authenticated RCE via `.phar` file upload from `public/media`9.6 · Critical
- TypebotCVE-2026-62862Account takeover by anonymous brute-force of the six-digit magic-link login code (no rate limit, no lockout on the verify endpoint)9.1 · Critical
- TypebotCVE-2026-62865Arbitrary server file read via the Send Email block attachment path (missing `disableFileAccess`/`disableUrlAccess` options)7.7 · High
- TypebotrequestedServer-Side Request Forgery in the HTTP Request block via a redirect bypass of the SSRF allowlist (incomplete fix of CVE-2025-64709)7.7 · High
- GhostCVE-2026-105680`permissible()` carries ownership branches for contributors on delete and authors on edit, but none for authors on delete; the catch-all `hasUserPermission || isPrimaryAuthor()` is already true, and the filtered bulk delete applies no author scoping at all6.5 · Medium
- TracecatrequestedThe expression editor's tooltip helpers inserted token-derived text as HTML rather than as a text node; a workflow editor thereby stores script that runs in a higher-privileged member's session7.3 · High
- Huginnnot assignedA shared scenario's description runs through `Kramdown` and `html_safe` with no filter at all; the script fires in the import preview before the victim confirms the import, taking over the account when the victim is an administrator8.1 · High
- GhostCVE-2026-103292The Author role creates a tag whose name is written unescaped into the `ld+json` block of every post page; a `</script>` inside it breaks out, and with no CSP every anonymous visitor runs the script, escalating to instance takeover for a logged-in administrator8.0 · High
- TracecatCVE-2026-58490Unauthenticated account takeover via unsigned SAML responses in Docker Compose (empty signing defaults disable signature verification) up to superadmin9.8 · Critical
- Element Webnot requestedStored XSS in the HTML chat export via message HTML and attachment filenames6.3 · Medium
- FreeScoutCVE-2026-53595Anonymous account takeover via `/user-setup` empty `invite_hash` (MySQL trailing-space)9.4 · Critical
- ts3-managerCVE-2026-54253Reflected XSS in the `/api/download` `port` parameter → theft of the operator session and ServerQuery password8.2 · High