Security Advisories
Real-world vulnerabilities discovered and responsibly disclosed by turingpoint in widely used open-source and enterprise software.
Security Research
Published Advisories
turingpoint conducts active security research on widely used open-source and enterprise software. Many of these vulnerabilities surface directly during penetration tests for our clients. The following findings were identified by us, disclosed to the vendors through coordinated disclosure, and published as CVEs once a patch became available. Security research made in Germany.
Sort by:
Product
CVE
Vulnerability
CVSS
Advisory
- OPNsenseCVE-2026-58390Stored XSS via OpenVPN `common_name` (RADIUS/LDAP) in the status views → code execution in the root admin session, escalating to root RCE8.0 · High
- OpenVAS Scannernot assigned`Image::from_str` filters empty segments only, so `..` from registry, image and tag reaches the unpack path; an unauthenticated scan creates directories outside the working directory as root, writes there, and on cleanup recursively deletes foreign trees9.0 · Critical
- LightdashrequestedThe metric query embeds `customDimensions[].sql` and `additionalMetrics[].sql` into the warehouse query with no permission check; the `interactive_viewer` role thereby runs arbitrary SQL without holding `manage:SqlRunner`8.8 · High
- ApostropheCMSCVE-2026-63667Arbitrary read of allow-listed-extension files via the attachment path built from the archive JSON in the `@apostrophecms/import-export` module (the `../` guard only checks tar entries, not the JSON fields)6.5 · Medium
- MalcolmCVE-2026-55676Authenticated RCE via unrestricted `.php` upload in the file-upload component (empty allowlist)8.8 · High
- CronicleCVE-2026-55562Stored XSS in the `full_name` field of the Activity Log → code execution in the admin session9.0 · Critical
- FleetrequestedCSV/formula injection in the host inventory export: host fields reported by the osquery agent reach `hosts/report?format=csv` unneutralized, triggerable down to the observer role4.4 · Medium
- OpenEMRrequestedSQL injection in the patient portal document API through `Id_BitwiseAnd`: any portal patient reads the whole database including other patients' records and admin password hashes7.7 · High
- TautulliCVE-2026-45381Reflected XSS in the `/search` `query` parameter (incomplete escaping) → API key theft7.4 · High
- GraylogCVE-2026-69190Manager-to-Owner privilege escalation via the `share_request` field of `PUT /api/views/{id}` (the update path checks `view:edit` instead of ownership) → deletion of other users' dashboards6.3 · Medium
- SurrealDBnot requestedAuthenticated path traversal via an analyzer `mapper` filter (arbitrary file read)7.7 · High
- Kanidmnot requestedAnonymous stack-overflow crash via deeply nested LDAP filter on LDAPS7.5 · High
- HeyFormnot requestedStored XSS in the form renderer: a `javascript:` URL with an inserted tab passes both server and client sanitizers and runs in the workspace owner's same-origin context8.7 · High
- SemaphoreCVE-2026-73293Privilege escalation from `manager` to `owner` via a custom-role slug collision (resolver ignores the project id, `ValidateRole` has no blocklist and no permission ceiling)8.8 · High
- UnleashCVE-2026-63462Unauthenticated denial of service via deeply nested JSON to OpenAPI-validated endpoints (unguarded `JSON.stringify` → `RangeError`, process crash)7.5 · High
- Portainerrequested`IsValidStackFile` rejects bind mounts from non-administrators in `volumes` but never checks `configs` and `secrets`, whose `file` names any host path; through the Docker socket this becomes control of the host9.4 · Critical
- Label Studionot requestedThe editor filter forbids event attributes through a denylist rather than an allowlist; `onfocusin` and the SMIL elements `animate` and `set` are missing from it, so task data runs script in the project lead's session9.0 · Critical
- Apache AirflowCVE-2026-58076Remote code execution in the Scheduler and the API server via an unchecked `import_string()` on the class name of an exception node in Dag deserialization (`executor_config` reaches the branch)8.8 · High
- Part-DBCVE-2026-54630Authenticated RCE via `.phar` file upload from `public/media`9.6 · Critical
- TypebotCVE-2026-62862Account takeover by anonymous brute-force of the six-digit magic-link login code (no rate limit, no lockout on the verify endpoint)9.1 · Critical