Vulnerabilities

TI-2026-53960 CVE-2026-77293

TREK: Cross-user note-file deletion (IDOR / Broken Access Control)

MEDIUM 64

TREK is a collaborative travel planner.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0038 Published 2026-09-24 Fixed in 3.3.0 CWE-639

TI-2026-53966 CVE-2026-77320

Information disclosure in mauriceboe TREK

MEDIUM 63

TREK is a collaborative travel planner.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00291 Published 2026-09-24 Fixed in 3.3.0 CWE-200

TI-2026-53967 CVE-2026-77321

TREK MCP trip summary bypasses delegated OAuth read scopes

LOW 19

TREK is a collaborative travel planner.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00199 Published 2026-09-24 Fixed in 3.3.0 CWE-200

TI-2026-53961 CVE-2026-77294

TREK: Server-Side Request Forgery via User-Configurable LLM Base URL

HIGH 70

TREK is a collaborative travel planner.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00308 Published 2026-09-24 Fixed in 3.3.0 CWE-918

TI-2026-44980 CVE-2026-62945

TREK: Cross-trip reservation title disclosure via file links

LOW 20

TREK is a collaborative travel planner.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-08-20 Fixed in 3.1.3 CWE-639

TI-2026-39355 CVE-2026-54509

TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

MEDIUM 62

TREK is a collaborative travel planner.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-08-20 Fixed in 3.1.0 CWE-862

TI-2026-39354 CVE-2026-54508

TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution

LOW 24

TREK is a collaborative travel planner.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00427 Published 2026-08-20 Fixed in 3.1.0 CWE-918

TI-2026-39351 CVE-2026-54505

TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

MEDIUM 44

TREK is a collaborative travel planner.

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00581 Published 2026-08-20 Fixed in 3.1.0 CWE-79

TI-2026-33199 CVE-2026-45410

Time-based user enumeration in TREK authentication endpoint

MEDIUM 63

TREK is a collaborative travel planner.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00205 Published 2026-05-28 Fixed in 3.0.18 CWE-203

TI-2026-28999 CVE-2026-40185

Missing Authorization on Immich Trip Photo Routes in TREK

LOW 31

TREK is a collaborative travel planner.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00213 Published 2026-04-10 Fixed in 2.7.2 CWE-862

TI-2026-28998 CVE-2026-40184

Unauthenticated Access to Uploaded Files in TREK

LOW 24

TREK is a collaborative travel planner.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00239 Published 2026-04-10 Fixed in 2.7.2 CWE-306

Vulnerabilities

Filters