Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: hcengineering Clear all filters
TI-2026-75392 CVE-2026-111606 · GHSA-8cm6-vrv9-4v98

Missing authorization in Huly Platform enables account takeover

Priority LOW 39

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00238 Published 2026-10-16 No fix listed CWE-862
TI-2026-61868 CVE-2026-91079 · GHSA-prm2-rg4g-w438

Huly Platform through 0.7.426 SSRF via Print Service

Priority LOW 28

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00369 Published 2026-09-14 No fix listed CWE-918
TI-2026-40933 CVE-2026-56769 · GHSA-wg7f-c2g2-5gwm

Huly Platform - Server-Side Request Forgery via /import Endpoint

Priority MEDIUM 61

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server request…

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00369 Published 2026-06-25 Fixed CWE-918