Vulnerabilities

TI-2026-51736 CVE-2026-73652 · GHSA-47w6-gwp4-w6vc

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

LOW 31

vantage6 is an open-source infrastructure for privacy preserving analysis.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00351 Published 2026-08-13 No fix listed CWE-863

TI-2026-39377 CVE-2026-54533 · GHSA-x9f6-9rvm-mmrg

vantage6 node has an Improper Access Control issue

LOW 36

vantage6 is an open-source infrastructure for privacy preserving analysis.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00285 Published 2026-06-17 Fixed in 5.0.0 CWE-284

TI-2026-39308 CVE-2026-54445 · GHSA-fgmc-2hqj-86v4

Vantage6: Set admin user and password from environment or configuration

LOW 32

vantage6 is an open-source infrastructure for privacy preserving analysis.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00292 Published 2026-06-17 Fixed in 5.0.0 CWE-1393

TI-2024-18531 CVE-2024-27928 · GHSA-4c5c-2vc3-x5w2

Vantage6: 2FA can be circumvented with hacked email access

LOW 26

vantage6 is an open-source infrastructure for privacy preserving analysis.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00278 Published 2026-06-17 Fixed in 5.0.0 CWE-308

TI-2024-16286 CVE-2024-24769 · GHSA-5549-c5q7-fj65

Vantage6: No limit on emails sent for password/MFA reset

LOW 11

vantage6 is an open-source infrastructure for privacy preserving analysis.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00278 Published 2026-06-17 Fixed in 5.0.0 CWE-400

TI-2025-28450 CVE-2025-43866 · GHSA-m3mq-f375-5vgh

Vantage6 Server JWT secret not cryptographically secure

LOW 10

vantage6 is an open-source infrastructure for privacy preserving analysis.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00387 Published 2025-06-12 Fixed in 4.11, 4.11.0 CWE-330

TI-2025-28447 CVE-2025-43863 · GHSA-j6g5-p62x-58hw

vantage6 lacks brute-force protection on change password functionality

LOW 10

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00466 Published 2025-06-12 Fixed in 4.11.0 CWE-307

TI-2024-21835 CVE-2024-32969 · GHSA-99r4-cjp4-3hmx

vantage6 collaboration admins can extend their influence by expanding the collaboration

LOW 14

vantage6 is an open-source infrastructure for privacy preserving analysis.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00319 Published 2024-05-23 Fixed in 4.5.0rc3 CWE-284

TI-2024-16183 CVE-2024-24562

Security headers not set in vantage6-UI

LOW 24

vantage6-UI is the official user interface for the vantage6 server.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00349 Published 2024-03-14 No fix listed CWE-668

TI-2024-15817 CVE-2024-23823 · GHSA-4946-85pr-fvxh

CORS settings overly permissive in vantage6

LOW 29

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00314 Published 2024-03-14 Fixed in 4.3.0 CWE-863

TI-2024-16287 CVE-2024-24770 · GHSA-5h3x-6gwf-73jm

Username timing attack on recover password/MFA token in vantage6

LOW 30

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00397 Published 2024-03-14 Fixed in 4.3.0 CWE-208

TI-2024-14793 CVE-2024-22200

vantage6-UI docker image leaks software version information

LOW 24

vantage6-UI is the User Interface for vantage6.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00335 Published 2024-01-30 Fixed in 4.2.0 CWE-200

TI-2024-14786 CVE-2024-22193 · GHSA-rjmv-52mp-gjrr

vantage6 unencrypted task can be created in encrypted collaboration

MEDIUM 53

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00257 Published 2024-01-30 Fixed in 4.2.0 CWE-922

TI-2024-14392 CVE-2024-21671 · GHSA-45gq-q4xh-cp53

vantage6 username timing attack

LOW 18

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00401 Published 2024-01-30 Fixed in 4.2.0 CWE-208

TI-2024-14378 CVE-2024-21653 · GHSA-2wgc-48g2-cj5w

vantage6 insecure SSH configuration for node and server containers

MEDIUM 48

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0047 Published 2024-01-30 Fixed in 4.2.0 CWE-284

TI-2024-14374 CVE-2024-21649 · GHSA-w9h2-px87-74vx

Remote code execution in vantage6

MEDIUM 43

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01266 Published 2024-01-30 Fixed in 4.2.0 CWE-94

TI-2023-25773 CVE-2023-47631 · GHSA-vc3v-ppc7-v486

vantage6 Node accepts non-whitelisted algorithms from malicious server

LOW 38

vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00446 Published 2023-11-14 Fixed in 4.1.2 CWE-345

TI-2023-22275 CVE-2023-41882 · GHSA-gc57-xhh5-m94r

vantage6 Improper Access Control vulnerability

LOW 25

vantage6 is privacy preserving federated learning infrastructure.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00497 Published 2023-10-11 Fixed in 4.0.0 CWE-284

TI-2023-22274 CVE-2023-41881 · GHSA-rf54-7qrr-96j6

Deleting a collaboration should also delete linked resources

LOW 20

vantage6 is privacy preserving federated learning infrastructure.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00354 Published 2023-10-11 Fixed in 4.0.0 CWE-200

TI-2023-13154 CVE-2023-28635 · GHSA-7x94-6g2m-3hp2

Defining resource name as integer in vantage6 may give unintended access

LOW 25

vantage6 is privacy preserving federated learning infrastructure.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00504 Published 2023-10-11 Fixed in 4.0.0 CWE-863

TI-2023-09728 CVE-2023-23930 · GHSA-5m22-cfq9-86x6

vantage6's Pickle serialization is insecure

LOW 34

vantage6 is privacy preserving federated learning infrastructure.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01108 Published 2023-10-11 Fixed in 4.0.0, 4.0.2 CWE-502

TI-2023-09727 CVE-2023-23929 · GHSA-4w59-c3gc-rrhp

Refresh tokens do not expire in Vantage6

MEDIUM 41

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00571 Published 2023-03-03 Fixed in 3.8.0 CWE-613

TI-2023-08912 CVE-2023-22738 · GHSA-vvjv-97j8-94xh

Improper Preservation of Permissions in vantage6

LOW 29

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00375 Published 2023-03-01 Fixed in 3.8.0 CWE-281

TI-2022-18606 CVE-2022-39228 · GHSA-36gx-9q6h-g429

Observable Response Discrepancy in vantage6

LOW 30

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00596 Published 2023-03-01 Fixed in 3.8.0 CWE-203

Vulnerabilities

Filters