CVE-2026-78372

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

CVE-2026-78370

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...

CVE-2026-78380

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

CVE-2026-78378

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/ endpoint attempted to resolve the supplied name to a known group or market, but when resolutio...

CVE-2026-78385

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

EUVD-2026-64891

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391

RansomLook contains a stored XSS in its cryptocurrency wallet detail view. Untrusted cryptocurrency addresses and blockchain names—sourced from external feeds such as the public ransomwhe.re crowd-sourcing feed—were stored without sufficient validation and rendered inside an inline JavaScript onc...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78387 RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

EUVD-2026-64890

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2026-78387 RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2026-78387

RansomLook has an authorization weakness in its web-based configuration editor at the /admin/config endpoint. The route requires an authenticated session but performs no explicit privilege or administrator authorization check , allowing any authenticated low-privileged user to write crafted value...

CVE-2026-78386 Unauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These...

CVE-2026-78386

RansomLook , a ransomware intelligence platform, exposed sensitive operator-side scraping configuration through multiple unauthenticated API endpoints. Location records tied to ransomware groups and markets were returned largely verbatim when not marked as private, leaking internal fields includi...

EUVD-2026-64888

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These...

CVE-2026-78386 Unauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These...

CVE-2026-78385

RansomLook contains an insufficient resource validation flaw in its analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and rendered via WeasyPrint . Prior to the fix, WeasyPrint's default URL fetcher resolved resource references without restrictions, all...

CVE-2026-78385 RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...