Mauriceboe vulnerabilities

Products

• Trek 17

Newest

• liketrek trek TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4) CVE-2026-85738 6.3 MediumSeptember 24, 2026
• mauriceboe trek TREK: Cross-user note-file deletion (IDOR / Broken Access Control) CVE-2026-77293 7.1 HighSeptember 24, 2026
• mauriceboe trek TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure) CVE-2026-77320 5.3 MediumSeptember 24, 2026
• mauriceboe trek TREK MCP trip summary bypasses delegated OAuth read scopes CVE-2026-77321 4.3 MediumSeptember 24, 2026
• mauriceboe trek TREK: Server-Side Request Forgery via User-Configurable LLM Base URL CVE-2026-77294 8.1 HighSeptember 24, 2026
• liketrek trek liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization CVE-2026-78887 6.3 MediumAugust 25, 2026
• liketrek trek liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal CVE-2026-78886 6.3 MediumAugust 25, 2026
• liketrek trek liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication CVE-2026-78885 6.3 MediumAugust 25, 2026
• liketrek trek liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection CVE-2026-78864 5.3 MediumAugust 25, 2026
• liketrek trek liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication CVE-2026-78863 5.3 MediumAugust 25, 2026
• mauriceboe trek TREK: Cross-trip reservation title disclosure via file links CVE-2026-62945 4.3 MediumAugust 20, 2026
• mauriceboe trek TREK IDOR: any authenticated user can read another user's journey share token (full journey leak) CVE-2026-54509 6.5 MediumAugust 20, 2026
• mauriceboe trek TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution CVE-2026-54508 5.3 MediumAugust 20, 2026
• mauriceboe trek TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner CVE-2026-54505 2.0 LowAugust 20, 2026
• mauriceboe trek Time-based user enumeration in TREK authentication endpoint CVE-2026-45410 5.3 MediumMay 28, 2026
• mauriceboe trek Missing Authorization on Immich Trip Photo Routes in TREK CVE-2026-40185 7.1 HighApril 10, 2026
• mauriceboe trek Unauthenticated Access to Uploaded Files in TREK CVE-2026-40184 3.7 LowApril 10, 2026