Priority LOW 24
Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00272 · Published 2026-10-20 · No fix listed CWE-639
Priority MEDIUM 60
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00237 · Published 2026-10-14 · No fix listed CWE-639
Priority HIGH 73
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01063 · Published 2026-10-12 · No fix listed CWE-24
Priority MEDIUM 64
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00422 · Published 2026-09-04 · No fix listed CWE-639
Priority HIGH 73
Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessa…
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00689 · Published 2026-09-04 · No fix listed CWE-639
Priority LOW 39
Blinko is an AI-powered card note-taking project.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00368 · Published 2026-03-23 · Fixed in 1.8.4 CWE-78
Priority LOW 36
Blinko is an AI-powered card note-taking project.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00313 · Published 2026-03-23 · Fixed in 1.8.4 CWE-22
Priority LOW 36
Blinko is an AI-powered card note-taking project.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00316 · Published 2026-03-23 · Fixed in 1.8.4 CWE-639
Priority LOW 26
Blinko is an AI-powered card note-taking project.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00228 · Published 2026-03-23 · Fixed in 1.8.4 CWE-639
Priority LOW 38
Blinko is an AI-powered card note-taking project.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00711 · Published 2026-03-23 · Fixed in 1.8.4 CWE-200
Priority LOW 30
Blinko is an AI-powered card note-taking project.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00357 · Published 2026-03-23 · Fixed in 1.8.4 CWE-288
Priority LOW 24
Blinko is an AI-powered card note-taking project.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00389 · Published 2026-03-23 · Fixed in 1.8.4 CWE-22
Priority LOW 24
Blinko is an AI-powered card note-taking project.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00349 · Published 2026-03-23 · No fix listed CWE-22
Priority LOW 38
Blinko is an AI-powered card note-taking project.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00771 · Published 2026-03-23 · No fix listed CWE-22
Priority LOW 39
Blinko is an AI-powered card note-taking project.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.01523 · Published 2026-03-23 · Fixed in 1.8.4 CWE-22
THREATIST.IORead the docs