Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Finsys dockhand 1.0.45 Clear all filters
TI-2026-73457 CVE-2026-110254 · GHSA-hvwx-hhfv-4fvx

Server-side request forgery in Finsys Dockhand via IPv6 transition addresses

Priority LOW 24

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00253 Published 2026-10-13 Fixed in 1.0.45 CWE-918
TI-2026-73418 CVE-2026-110130 · GHSA-4xvp-4f97-666q

Authentication bypass in Finsys Dockhand via static-asset check

Priority HIGH 82

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation hand…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00716 Published 2026-10-13 Fixed in 1.0.45 CWE-288