GHSA-274F-6W77-8QM9 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/register. Required attacker capability: Valid login and password for a TOTP-enabled account with desktop sync permission. Summary POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. In the...

CVE-2026-95666 Unbounded post ID array in the bulk reactions endpoint allows denial of service

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to POST...

PT-2026-96724

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1 Description An authenticated user can cause excessive database load by...

PT-2026-97050

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 8.0.3 Description The admin API contains five authorization issues. A missing await keyword in the POST /api/admin/segments/strategies endpoint allows authenticated users to modify segment assignments without the...

PT-2026-97048

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 8.0.3 Description An issue exists where the system authorizes the creation of a feature in a destination project but fails to verify if the user has access to the source project. Since feature names are globally uniqu...

CVE-2026-76910: Authorization Bypass Through User-Controlled Key

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-58269

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns full access and refresh JWTs without checking whether the account has TO...

CVE-2026-58269 Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns full access and refresh JWTs without checking whether the account has TO...

CVE-2026-58269 Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns full access and refresh JWTs without checking whether the account has TO...

CVE-2026-58269

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0 , the POST /api/auth/token endpoint authenticates users with only username and password, then calls getTokens(), which returns full access and refresh JWTs without checking whet...

CVE-2026-58271 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...

CVE-2026-61744

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

CVE-2026-61744 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

CVE-2026-61744

InvenTree , an open-source inventory management system, is affected by an authorization bypass in its barcode-scan API (POST /api/barcode/) prior to 1.4.0 . The endpoint requires only authentication or a general read scope via IsAuthenticatedOrReadScope, and the built-in barcode plugin resolves o...

SUSE CVE-2026-59834

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNI...

CVE-2026-77561 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

SUSE CVE-2026-73293

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

SUSE CVE-2026-73294

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...