CVE Program partner

sba-research

SBA Research gGmbH

API
CVEs, 365 days1017 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationSBA Research gGmbH
RoleCNA
TypeResearcher
Reports tomitre
ScopeVulnerabilities discovered by SBA Research or reported to SBA Research by partner organizations that are not in another CNA’s scope.
Advisorieshttps://github.com/sbaresearch/advisories

Latest CVEs · RSS

  • CVE-2026-16970 2026-07-30 · CVSS 4.2
    The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be mis
  • CVE-2026-18362 2026-07-30 · CVSS 5.9
    The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
  • CVE-2026-16971 2026-07-30 · CVSS 5.9
    The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
  • CVE-2026-18361 2026-07-30 · CVSS 7.6
    The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.
  • CVE-2026-18360 2026-07-30 · CVSS 7.6
    The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
  • CVE-2026-16969 2026-07-30 · CVSS 7.6
    The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
  • CVE-2026-13211 2026-07-01 · CVSS 4.3
    The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with t
  • CVE-2025-41259 2026-06-03 · CVSS 7.3
    SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to ro
  • CVE-2025-41258 2026-03-18 · CVSS 8.0
    LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG AP
  • CVE-2025-41257 2026-03-04 · CVSS 4.8
    Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabili
  • CVE-2025-41255 2025-06-25 · CVSS 8.0
    Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows
  • CVE-2025-41256 2025-06-25 · CVSS 7.4
    Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored
  • CVE-2024-13919 2025-03-10 · CVSS 8.0
    The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in t
  • CVE-2024-13918 2025-03-10 · CVSS 8.0
    The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in
  • CVE-2024-5676 2024-06-19 · CVSS 6.8
    The Paradox IP150 Internet Module in version 1.40.00 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of countermeasures and the use of
  • CVE-2024-5658 2024-06-06 · CVSS 4.8
    The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.
  • CVE-2024-5657 2024-06-06 · CVSS 3.7
    The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submittin

All CVE Program partners