Vulnerabilities

TI-2026-19240 CVE-2026-23882

Blinko: Admin RCE - MCP Server Command Injection

LOW 39

Blinko is an AI-powered card note-taking project.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00368 Published 2026-03-23 Fixed in 1.8.4 CWE-78

TI-2026-18918 CVE-2026-23485

Blinko: Unauthorized Path Traversal File Enumeration - music-metadata

LOW 36

Blinko is an AI-powered card note-taking project.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00313 Published 2026-03-23 Fixed in 1.8.4 CWE-22

TI-2026-18921 CVE-2026-23488

Blinko: multiple interfaces in the comment feature allow unauthorized access

LOW 36

Blinko is an AI-powered card note-taking project.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00316 Published 2026-03-23 Fixed in 1.8.4 CWE-639

TI-2026-18920 CVE-2026-23487

Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token

LOW 26

Blinko is an AI-powered card note-taking project.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00228 Published 2026-03-23 Fixed in 1.8.4 CWE-639

TI-2026-18919 CVE-2026-23486

Blinko: Unauthorized User Information Leak

LOW 38

Blinko is an AI-powered card note-taking project.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00711 Published 2026-03-23 Fixed in 1.8.4 CWE-200

TI-2026-18913 CVE-2026-23480

Blinko: Low Privilege User Privilege Escalation - upsertUser Endpoint

LOW 30

Blinko is an AI-powered card note-taking project.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00357 Published 2026-03-23 Fixed in 1.8.4 CWE-288

TI-2026-18914 CVE-2026-23481

Blinko: Authenticated Arbitrary File Write - saveAdditionalDevFile

LOW 24

Blinko is an AI-powered card note-taking project.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00389 Published 2026-03-23 Fixed in 1.8.4 CWE-22

TI-2026-18917 CVE-2026-23484

Blinko: Authenticated Arbitrary File Write - saveDevPlugin

LOW 24

Blinko is an AI-powered card note-taking project.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00349 Published 2026-03-23 No fix listed CWE-22

TI-2026-18916 CVE-2026-23483

Blinko: Unauthorized Arbitrary File Read - /plugins

LOW 38

Blinko is an AI-powered card note-taking project.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00771 Published 2026-03-23 No fix listed CWE-22

TI-2026-18915 CVE-2026-23482

Blinko: Unauthorized Arbitrary File Read - /api/file/temp

LOW 39

Blinko is an AI-powered card note-taking project.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.01523 Published 2026-03-23 Fixed in 1.8.4 CWE-22

Vulnerabilities

Filters