TI-2026-81513 CVE-2026-116683 · GHSA-vg84-c5mg-76xh
CTFd Terraform Provider exposes team passwords in Terraform state
Priority LOW 31
CTFer.io's CTFd Terraform Provider manages CTFd resources as code.
Vulnerabilities
10 records
TI-2026-25257 CVE-2026-32768 · GHSA-mw24-f3xh-j3qv
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Priority MEDIUM 40
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player.
TI-2026-25260 CVE-2026-32771 · GHSA-f7cq-gvh6-qr25
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization
Priority MEDIUM 45
The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e.
TI-2026-25258 CVE-2026-32769 · GHSA-hxm7-9q36-c77f
Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Priority LOW 32
Fullchain is an umbrella project for deploying a ready-to-use CTF platform.
TI-2026-25275 CVE-2026-32805 · GHSA-p799-g7vv-f279
Romeo is vulnerable to Archive Slip due to missing checks in sanitization
Priority HIGH 77
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions.
TI-2026-25229 CVE-2026-32737 · GHSA-fgm3-q9r5-43v9
Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Priority MEDIUM 41
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions.
TI-2026-25212 CVE-2026-32720 · GHSA-7x23-j8gv-v54x
Improper Access Control in github.com/ctfer-io/monitoring
Priority LOW 37
The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e.
TI-2025-33561 CVE-2025-53634 · GHSA-ggmv-j932-q89q
Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacks
Priority MEDIUM 44
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player.
TI-2025-33560 CVE-2025-53633 · GHSA-r7fm-3pqm-ww5w
Chall-Manager's scenario decoding process does not check for zip bombs
Priority MEDIUM 44
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player.
TI-2025-33559 CVE-2025-53632 · GHSA-3gv2-v3jx-r9fh
Chall-Manager's scenario decoding process does not check for zip slips
Priority MEDIUM 40
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player.