Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: mlogclub Clear all filters
TI-2026-84345 CVE-2026-121452 · GHSA-4ffj-9jv6-m8p5

Improper TLS certificate validation in bbs-go SMTP email service

Priority LOW 36

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00235 Published 2026-11-03 No fix listed CWE-295
TI-2026-75425 CVE-2026-111639 · GHSA-h5hh-rp4r-9p9x

bbs-go Account Takeover via Google One Tap Login

Priority HIGH 72

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth clie…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00473 Published 2026-10-16 No fix listed CWE-287
TI-2026-71989 CVE-2026-110103 · GHSA-rm26-pxjp-76q3

Stored cross-site scripting in bbs-go via spoofed upload Content-Type

Priority LOW 23

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00226 Published 2026-10-13 No fix listed CWE-79
TI-2026-65682 CVE-2026-103396 · GHSA-wr27-gh7c-5q9v

bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

Priority LOW 24

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00286 Published 2026-09-30 No fix listed CWE-863