Read the docs

pawelmalak

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

pawelmalak records in CISA KEV

No pawelmalak vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-64667 CVE-2026-100418 · GHSA-57pv-56rc-p5hq

Flame through 2.4.0 Information Exposure via GET /api/config

Priority HIGH 70

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00425 Published 2026-09-25 No fix listed CWE-200
TI-2026-64670 CVE-2026-100502 · GHSA-h3fx-87pr-c7fx

Flame through 2.4.0 Admin Token Insufficient Session Expiration

Priority MEDIUM 60

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated durati…

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00364 Published 2026-09-25 No fix listed CWE-613
TI-2026-64669 CVE-2026-100501 · GHSA-r7p3-q524-5mc7

Flame through 2.4.0 Brute-Force Attack via Login Endpoint

Priority LOW 36

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00292 Published 2026-09-25 No fix listed CWE-307
Open these records in search →