Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: eidetic-labs stigmem 0.9.0a2 Clear all filters
TI-2026-53350 CVE-2026-76245 · GHSA-rh24-296r-8rj6

stigmem Federation Peer Token Timestamp Validation Bypass

Priority LOW 31

stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00238 Published 2026-08-19 Fixed in 0.9.0a2 CWE-345
TI-2026-53349 CVE-2026-76244 · GHSA-pxm8-2h3h-jwmv

stigmem-node Insecure Federation Transport Configuration

Priority MEDIUM 41

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00268 Published 2026-08-19 Fixed in 0.9.0a2 CWE-319
TI-2026-53348 CVE-2026-76243 · GHSA-rqm4-4g3h-95wm

stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth

Priority MEDIUM 48

stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00564 Published 2026-08-19 Fixed in 0.9.0a2 CWE-285
TI-2026-53347 CVE-2026-76242 · GHSA-rgmr-4wwg-2c6j

stigmem Federation Peer Registration Authentication Bypass

Priority MEDIUM 41

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00346 Published 2026-08-19 Fixed in 0.9.0a2 CWE-295
TI-2026-53346 CVE-2026-76241 · GHSA-q84h-wr78-498w

stigmem Plugin Signature Enforcement Bypass via Configuration

Priority LOW 33

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00115 Published 2026-08-19 Fixed in 0.9.0a2 CWE-494
TI-2026-53345 CVE-2026-76240 · GHSA-vgv8-r42h-hgr6

stigmem Postgres SQL Injection via Schema Identifier

Priority LOW 35

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00383 Published 2026-08-19 Fixed in 0.9.0a2 CWE-89