EUVD-2026-87365

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418

The software Flame through 2.4.0 contains an information exposure vulnerability within the unauthenticated GET /api/config endpoint. The root cause is a lack of field redaction, allowing the endpoint to return the entire configuration object. Attackers can send a single unauthenticated request to...

PT-2026-99130

Name of the Vulnerable Software and Affected Versions Flame versions prior to 2.4.1 Description An information exposure issue exists in the unauthenticated 'GET /api/config' endpoint, which returns the complete configuration object without redacting sensitive fields. This allows an attacker to...

CVE-2026-100418: Exposure of Sensitive Information to an Unauthorized Actor

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-32890: Improper Neutralization of Input During Web Page Generation

Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a stored Cross-site Scripting XSS vulnerability in the web dashboard's User Mapping dropdown allows any unprivileged Discord user in the...