OPENSUSE-SU-2026:11798-1 go-passbolt-cli-0.5.2-1.1 on GA media

These are all security issues fixed in the go-passbolt-cli-0.5.2-1.1 package on the GA media of openSUSE Tumbleweed...

Passbolt Login Panel Detection

Passbolt login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Passbolt login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Passbolt Login Panel Detection', 'description':...

WS-2019-0496

Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user to inject bash code. The impact is ve...

WS-2019-0494

Stored XSS on first/last name during setup was found in Passbolt before v2.11.0. An administrator can craft a user with a malicious first name and last name, using a payload such as The user will then receive the invitation email and click on the setup link. The setup's start page served by the...

WS-2020-0200

An e-mail HTML injection vulnerability was found in Passbolt before v2.7.0. Passbolt sends an e-mail to users to warn them about different types of events such as the creation, modification, or deletion of a password. Those e-mails may contain user-specified input, such as a password's title or...

WS-2019-0498

Passbolt implements a mechanism to verify the server's authenticity. The /auth/verify.json endpoint used to verify the server's authenticity returns a JSON that displays errors that occurred during the request. An attacker could use this unauthenticated endpoint to enumerate users registered on a...

WS-2019-0497

Passbolt uses three cookies: a session cookie, a CSRF protection cookie and a cookie to keep track of the multiple-factor authentication process. Both the session cookie and the mfa cookie are properly set HTTP-only to prevent an attacker from retrieving the content of those cookies if they manag...

EUVD-2025-7821

Malicious code in bioql PyPI...

EUVD-2022-4256

Malicious code in bioql PyPI...

EUVD-2024-1067

Malicious code in bioql PyPI...

EUVD-2024-31382

Malicious code in bioql PyPI...

CVE-2024-33670

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy CSP restrictions, it may still impact the appearance and...

CVE-2024-33669

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...

CVE-2017-1000442

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

CVE-2025-27913: Use of Less Trusted Source

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...