Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: freedomofpress Clear all filters
TI-2026-86124 CVE-2026-71863

SecureDrop copies Onion Service credentials to Monitor Server

Priority LOW 13

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources.

CVSS 3.1LOW 2.6 Network High privileges User interaction EPSS 0.00214 Published 2026-11-06 Fixed in 2.16.1 CWE-201
TI-2026-83225 CVE-2026-50000

SecureDrop lets API session tokens be reused against the web UI

Priority LOW 23

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources.

CVSS 3.1MEDIUM 5.0 Network High privileges No interaction EPSS 0.00359 Published 2026-10-30 Fixed in 2.16.0 CWE-863
TI-2025-18591 CVE-2025-24889

Path traversal in sd-log Qubes virtual machine

Priority LOW 20

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation.

CVSS 3.1MEDIUM 4.5 Local No auth No interaction EPSS 0.00195 Published 2025-02-13 Fixed in 0.14.1 CWE-22
TI-2025-18590 CVE-2025-24888

Path traversal in SecureDrop Client API.download_reply()

Priority LOW 39

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01004 Published 2025-02-13 Fixed in 0.14.1 CWE-22