Skip to content
OpenAdvisories

Vendor

blinkospace

14 known vulnerabilities.

Products

blinko 14
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-85607

    Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router

    Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.t…

    blinkospace blinko
  • High 8.6
    CVE-2026-23882

    Blinko: Admin RCE - MCP Server Command Injection

    Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched…

    blinkospace blinko
  • High 8.2
    CVE-2026-23482 Scanner template

    Blinko: Unauthorized Arbitrary File Read - /api/file/temp

    Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on th…

    blinkospace blinko