https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T15:00:16.169261+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-256947 EUVD-2026-256947 2026-10-06T15:00:16.171373+00:00 EUVD-2026-256947 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27222 fkie_cve-2025-27222 2026-10-06T15:00:16.171428+00:00

TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.

 https://cve.radiocsirt.org/vuln/ghsa-pppq-6rq6-872v GHSA-pppq-6rq6-872v 2026-10-06T15:00:16.171476+00:00

TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.