OPENSUSE-SU-2026:11798-1 go-passbolt-cli-0.5.2-1.1 on GA media

These are all security issues fixed in the go-passbolt-cli-0.5.2-1.1 package on the GA media of openSUSE Tumbleweed...

Passbolt Login Panel Detection

Passbolt login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Passbolt login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Passbolt Login Panel Detection', 'description':...

WS-2019-0496

Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user to inject bash code. The impact is ve...

WS-2019-0494

Stored XSS on first/last name during setup was found in Passbolt before v2.11.0. An administrator can craft a user with a malicious first name and last name, using a payload such as The user will then receive the invitation email and click on the setup link. The setup's start page served by the...

WS-2020-0200

An e-mail HTML injection vulnerability was found in Passbolt before v2.7.0. Passbolt sends an e-mail to users to warn them about different types of events such as the creation, modification, or deletion of a password. Those e-mails may contain user-specified input, such as a password's title or...

WS-2019-0498

Passbolt implements a mechanism to verify the server's authenticity. The /auth/verify.json endpoint used to verify the server's authenticity returns a JSON that displays errors that occurred during the request. An attacker could use this unauthenticated endpoint to enumerate users registered on a...

WS-2019-0497

Passbolt uses three cookies: a session cookie, a CSRF protection cookie and a cookie to keep track of the multiple-factor authentication process. Both the session cookie and the mfa cookie are properly set HTTP-only to prevent an attacker from retrieving the content of those cookies if they manag...

EUVD-2025-7821

Malicious code in bioql PyPI...

EUVD-2022-4256

Malicious code in bioql PyPI...

EUVD-2024-31382

Malicious code in bioql PyPI...

EUVD-2024-1067

Malicious code in bioql PyPI...

CVE-2024-33670

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy CSP restrictions, it may still impact the appearance and...

CVE-2024-33669

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...

CVE-2017-1000442

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

CVE-2025-27913

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

PT-2025-10631

Name of the Vulnerable Software and Affected Versions Passbolt API versions prior to 5 Description The issue arises when the server is misconfigured, specifically with an incorrect installation process and disregard of Health Check results. In such cases, the Passbolt API can send email messages...

CVE-2025-27913: Use of Less Trusted Source

Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...

CVE-2025-27913

The Passbolt API (versions prior to 5 ) is vulnerable to a Host Header Injection flaw (CWE-348) when the server is misconfigured. This occurs if the installation process is incorrect and Health Check results are disregarded, allowing an attacker to control the HTTP Host header . Consequently, the...