Skip to contentBlinkospace Blinko vulnerabilities
- blinkospace blinkoBlinko through 1.8.8 IDOR via Tag tRPC Router ProceduresCVE-2026-1135975.3 Medium
- blinkospace blinkoBlinko through 1.8.8 Private Attachment Read via /api/file RouteCVE-2026-1107746.0 Medium
- blinkoBlinko through 1.8.8 allows directory traversal, overwriting startup files as root, via...CVE-2026-1089808.8 High
- blinkospace blinkoBlinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceListCVE-2026-856247.1 High
- blinkospace blinkoBlinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC RouterCVE-2026-856078.7 High
- blinkoBlinko: Admin RCE - MCP Server Command InjectionCVE-2026-238828.6 High
- blinkoBlinko: Unauthorized Path Traversal File Enumeration - music-metadataCVE-2026-234856.9 Medium
- blinkoBlinko: multiple interfaces in the comment feature allow unauthorized accessCVE-2026-234886.9 Medium
- blinkoBlinko: IDOR - user.detail Endpoint Leaks Superadmin TokenCVE-2026-234876.0 Medium
- blinkoBlinko: Unauthorized User Information LeakCVE-2026-234866.9 Medium
- blinkoBlinko: Low Privilege User Privilege Escalation - upsertUser EndpointCVE-2026-234805.3 Medium
- blinkoBlinko: Authenticated Arbitrary File Write - saveAdditionalDevFileCVE-2026-234815.3 Medium
- blinkoBlinko: Authenticated Arbitrary File Write - saveDevPluginCVE-2026-234845.3 Medium
- blinkoBlinko: Unauthorized Arbitrary File Read - /pluginsCVE-2026-234836.9 Medium
- blinkoBlinko: Unauthorized Arbitrary File Read - /api/file/tempCVE-2026-234828.2 High