Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: datavane Clear all filters
TI-2026-48507 CVE-2026-69101 · GHSA-pfrg-4vg3-g532

Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint

Priority HIGH 69

Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskSc…

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00432 Published 2026-08-14 No fix listed CWE-611
TI-2026-20015 CVE-2026-24816 · GHSA-237f-mxrr-mcvr

Cookie Security Vulnerabilities in datavane/tis

Priority MEDIUM 49

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in datavane tis (tis-console/src/main/java/com/qlangtech/tis/runtime/module/action modules).

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00294 Published 2026-01-27 Fixed CWE-835
TI-2026-20014 CVE-2026-24815 · GHSA-mhvc-rf83-29wq

A XStream Security Vulnerability in XML Deserialization in datavane/tis

Priority MEDIUM 49

Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/extension/impl modules).

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00353 Published 2026-01-27 Fixed CWE-434