https://vulnerability.circl.lu Vulnerabilities published under the CPE names of Vulnerability-Lookup. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 20:36:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-101041 Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover https://vulnerability.circl.lu/vuln/cve-2026-101041 Sun, 27 Sep 2026 14:47:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73374 Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup https://vulnerability.circl.lu/vuln/cve-2026-73374 Wed, 12 Aug 2026 14:05:39 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73405 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup https://vulnerability.circl.lu/vuln/cve-2026-73405 Wed, 12 Aug 2026 14:15:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup https://vulnerability.circl.lu/vuln/cve-2026-73431 Wed, 12 Aug 2026 14:32:56 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup https://vulnerability.circl.lu/vuln/cve-2026-73432 Wed, 12 Aug 2026 14:40:15 +0000 https://vulnerability.circl.lu/vuln/cve-2026-72761 Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup https://vulnerability.circl.lu/vuln/cve-2026-72761 Mon, 10 Aug 2026 14:33:13 +0000 https://vulnerability.circl.lu/vuln/cve-2025-42615 Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup https://vulnerability.circl.lu/vuln/cve-2025-42615 Mon, 08 Dec 2025 12:01:05 +0000 https://vulnerability.circl.lu/vuln/cve-2025-42616 CSRF vulnerability in CIRCL Vulnerability-Lookup CSRF vulnerability in CIRCL Vulnerability-Lookup https://vulnerability.circl.lu/vuln/cve-2025-42616 Mon, 08 Dec 2025 12:09:22 +0000 https://vulnerability.circl.lu/vuln/cve-2025-42620 CSRF vulnerability in CIRCL Vulnerability-Lookup CSRF vulnerability in CIRCL Vulnerability-Lookup https://vulnerability.circl.lu/vuln/cve-2025-42620 Mon, 08 Dec 2025 12:15:15 +0000 https://vulnerability.circl.lu/vuln/cve-2025-60249 vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or sightings. A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Bundles, Comments, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models. vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or sightings. A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Bundles, Comments, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models. https://vulnerability.circl.lu/vuln/cve-2025-60249 Thu, 25 Sep 2025 00:00:00 +0000