https://vulnerability.circl.lu/product/651684fd-f2b4-45ac-96d0-e3e484af6113/recent 2026-09-29T14:59:28.138587+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Vulnerabilities published under the CPE names of Vulnerability-Lookup. https://vulnerability.circl.lu/vuln/cve-2026-101041 2026-09-27T14:47:57.012000+00:00 Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover

Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover

2026-09-27T14:47:57.012000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-73374 2026-08-12T17:12:36.380000+00:00 Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup

Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup

2026-08-12T14:05:39.735000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-73405 2026-08-12T17:10:19.723000+00:00 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup

Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup

2026-08-12T14:15:58.039000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-73431 2026-08-12T17:07:39.056000+00:00 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

2026-08-12T14:32:56.538000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-73432 2026-08-12T17:03:03.041000+00:00 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

2026-08-12T14:40:15.966000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-72761 2026-08-10T17:00:48.661000+00:00 Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup

Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup

2026-08-10T14:33:13.106000+00:00 https://vulnerability.circl.lu/vuln/cve-2025-42615 2025-12-08T20:10:21.202000+00:00 Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup

Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup

2025-12-08T12:01:05.831000+00:00 https://vulnerability.circl.lu/vuln/cve-2025-42616 2025-12-08T14:46:41.970000+00:00 CSRF vulnerability in CIRCL Vulnerability-Lookup

CSRF vulnerability in CIRCL Vulnerability-Lookup

2025-12-08T12:09:22.893000+00:00 https://vulnerability.circl.lu/vuln/cve-2025-42620 2025-12-08T12:27:15.797000+00:00 CSRF vulnerability in CIRCL Vulnerability-Lookup

CSRF vulnerability in CIRCL Vulnerability-Lookup

2025-12-08T12:15:15.950000+00:00 https://vulnerability.circl.lu/vuln/cve-2025-60249 2025-09-26T17:44:06.988000+00:00 vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or sightings. A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Bundles, Comments, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models.

vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or sightings. A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Bundles, Comments, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models.

2025-09-25T00:00:00+00:00