CVE-2026-41161

Summary: CVE-2026-41161 affects Sync-in Server before version 2.2.0. The /api/auth/login endpoint exposes a timing-based flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring response times. This is confirmed in the GitHub advisory and CVE descriptions, which...

CVE-2025-67438

A Stored Cross-Site Scripting (XSS) vulnerability exists in Sync-in Server versions prior to 1.9.3 . An authenticated attacker can exploit this by uploading a crafted SVG file containing a malicious payload. This allows the execution of arbitrary JavaScript in a victim's browser, which can be use...