Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Government Accountability Office Clear all filters
TI-2026-39031 CVE-2026-54106 · GHSA-96f7-vmp7-7rvh

U.S. GAO EPDS and CBCA EDS network access control bypass

Priority MEDIUM 56

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, all…

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00491 Published 2026-06-18 Fixed in 2026-02-22, 2026-03-19 CWE-940
TI-2026-39030 CVE-2026-54105 · GHSA-79rr-2p25-73c5

U.S. GAO EPDS and CBCA EDS user information disclosure

Priority LOW 37

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00505 Published 2026-06-18 Fixed in 2026-02-22, 2026-03-19 CWE-639
TI-2026-39029 CVE-2026-54104 · GHSA-768x-r5g5-79vc

U.S. GAO EPDS and CBCA EDS client-based privilege escalation

Priority MEDIUM 41

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00724 Published 2026-06-18 Fixed in 2026-02-22, 2026-03-19 CWE-602
TI-2026-39028 CVE-2026-54103 · GHSA-w9xh-mqg8-v8fv

U.S. GAO EPDS and CBCA EDS unauthenticated password change

Priority MEDIUM 49

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00772 Published 2026-06-18 Fixed in 2026-02-22, 2026-03-19 CWE-306