Advisories · Technology
blinko.
Every CVE that names blinko among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures
- blinko
- Broken access control
- CVSS 6.0 Medium
Blinko through 1.8.8 Private Attachment Read via /api/file Route
- blinko
- Broken access control
- CVSS 8.8 High
Path traversal in Blinko
- Blinko
- Path traversal
- CVSS 7.1 High
Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList
- blinko
- Broken access control
- CVSS 8.7 High
Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router
- blinko
- Broken access control
- CVSS 8.6 High
Blinko: Admin RCE - MCP Server Command Injection
- blinko
- Command injection
- CVSS 6.9 Medium
Blinko: Unauthorized Path Traversal File Enumeration - music-metadata
- blinko
- Path traversal
- CVSS 6.9 Medium
Blinko: multiple interfaces in the comment feature allow unauthorized access
- blinko
- Broken access control
- CVSS 6.0 Medium
Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token
- blinko
- Broken access control
- CVSS 6.9 Medium
Blinko: Unauthorized User Information Leak
- blinko
- Information disclosure
- CVSS 5.3 Medium
Blinko: Low Privilege User Privilege Escalation - upsertUser Endpoint
- blinko
- Authentication bypass
- CVSS 5.3 Medium
Blinko: Authenticated Arbitrary File Write - saveAdditionalDevFile
- blinko
- Path traversal
- CVSS 5.3 Medium
Blinko: Authenticated Arbitrary File Write - saveDevPlugin
- blinko
- Path traversal
- CVSS 6.9 Medium
Blinko: Unauthorized Arbitrary File Read - /plugins
- blinko
- Path traversal
- CVSS 8.2 High
Blinko: Unauthorized Arbitrary File Read - /api/file/temp
- blinko
- Path traversal