76 matches found
CVE-2026-71863
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...
EUVD-2026-118497
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...
CVE-2026-71863 SecureDrop: Onion Service client auth credentials copied to Monitor Server
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...
CVE-2026-71863 SecureDrop: Onion Service client auth credentials copied to Monitor Server
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...
CVE-2026-71863
The SecureDrop whistleblower submission system (versions 2.13.0 through 2.16.1 ) is vulnerable to sensitive data exposure. When running the securedrop-admin install Ansible playbook with journalist alerts disabled, the system leaves the journalist alert key filename empty. This causes a copy task...
Malicious Package
Overview securedrop-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-50000
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...
EUVD-2026-114255
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...
CVE-2026-50000 SecureDrop: API session token reuse against the Journalist Interface web UI
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...
CVE-2026-50000 SecureDrop: API session token reuse against the Journalist Interface web UI
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...
CVE-2026-50000
The SecureDrop whistleblower submission system (versions 2.5.0 through 2.16.0 ) is vulnerable to session token reuse. The SessionInterface maintains a mutable session key prefix that persists across requests, causing prefix corruption that confuses Redis session namespaces. This allows an attacke...
CVE-2026-50000 SecureDrop: API session token reuse against the Journalist Interface web UI
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...
PT-2026-133716
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...
CVE-2026-50000: freedomofpress securedrop: SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept…
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...
CVE-2026-49996
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
CVE-2026-49996
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
EUVD-2026-63576
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
CVE-2026-49996 securedrop-proxy origin limitation can be bypassed with redirects
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
CVE-2026-49996 securedrop-proxy origin limitation can be bypassed with redirects
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
CVE-2026-49996
Prior to version 1.3.1, SecureDrop Client's securedrop-proxy could be tricked by a malicious SecureDrop Server returning cross-origin redirects, bypassing the proxy's origin restriction and allowing requests to unintended destinations. CVSS 3.7 (Low) reflects network-based, high-complexity exploi...