https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 23:39:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277117 EUVD-2026-277117 https://cve.radiocsirt.org/vuln/euvd-2026-277117 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23480 <p>Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an optional parameter and if not provided password verification is skipped; there is no check for input.id === ctx.id (ownership verification). This could result in any authenticated user modifying other users&#39; passwords, direct escalation to superadmin, and complete account takeover. This issue has been patched in version 1.8.4.</p> <p>Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an optional parameter and if not provided password verification is skipped; there is no check for input.id === ctx.id (ownership verification). This could result in any authenticated user modifying other users&#39; passwords, direct escalation to superadmin, and complete account takeover. This issue has been patched in version 1.8.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23480