Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: pawelmalak Clear all filters
TI-2026-64670 CVE-2026-100502 · GHSA-h3fx-87pr-c7fx

Flame through 2.4.0 Admin Token Insufficient Session Expiration

Priority MEDIUM 60

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated durati…

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00364 Published 2026-09-25 No fix listed CWE-613
TI-2026-64669 CVE-2026-100501 · GHSA-r7p3-q524-5mc7

Flame through 2.4.0 Brute-Force Attack via Login Endpoint

Priority LOW 36

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00292 Published 2026-09-25 No fix listed CWE-307
TI-2026-64667 CVE-2026-100418 · GHSA-57pv-56rc-p5hq

Flame through 2.4.0 Information Exposure via GET /api/config

Priority HIGH 70

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00425 Published 2026-09-25 No fix listed CWE-200