https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T08:05:54.257609+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-267571 EUVD-2026-267571 2026-10-13T08:05:54.304015+00:00 EUVD-2026-267571 https://cve.radiocsirt.org/vuln/fkie_cve-2025-70963 fkie_cve-2025-70963 2026-10-13T08:05:54.304047+00:00

Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.

 https://cve.radiocsirt.org/vuln/ghsa-9f8m-9547-2gqm GHSA-9f8m-9547-2gqm — Gophish is vulnerable to Incorrect Access Control 2026-10-13T08:05:54.304081+00:00

Affected: Go: github.com/gophish/gophish

Gophish <= 0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.