mauriceboe vulnerabilities

Newest CVEs

• CVE-2026-77293

  TREK: Cross-user note-file deletion (IDOR / Broken Access Control)

  mauriceboe · TREK

  High7.1
• CVE-2026-77320

  TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)

  mauriceboe · TREK

  Medium5.3
• CVE-2026-77321

  TREK MCP trip summary bypasses delegated OAuth read scopes

  mauriceboe · TREK

  Medium4.3
• CVE-2026-77294

  TREK: Server-Side Request Forgery via User-Configurable LLM Base URL

  mauriceboe · TREK

  High8.1
• CVE-2026-62945

  TREK: Cross-trip reservation title disclosure via file links

  mauriceboe · TREK

  Medium4.3
• CVE-2026-54509

  TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

  mauriceboe · TREK

  Medium6.5
• CVE-2026-54508

  TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution

  mauriceboe · TREK

  Medium5.3
• CVE-2026-54505

  TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

  mauriceboe · TREK

  Low2.0
• CVE-2026-45410

  Time-based user enumeration in TREK authentication endpoint

  mauriceboe · TREK

  Medium5.3
• CVE-2026-40185

  Missing Authorization on Immich Trip Photo Routes in TREK

  mauriceboe · TREK

  High7.1