Skip to content
OpenAdvisories

Vendor

CERT/CC

12 known vulnerabilities.

Products

VINCE 5 VINCE - The Vulnerability Information and Coordination Environment 4 VINCE - Vulnerability Information and Coordination Environment 1 cveClient/encrypt-storage.js 1 cveClient/cveInterface.js 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-18744

    CVE-2026-18744

    Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affect…

    CERT/CC VINCE
  • Medium 5.3
    CVE-2026-18750

    CVE-2026-18750

    vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read…

    CERT/CC VINCE
  • Medium 6.5
    CVE-2026-8142

    CVE-2026-8142

    VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

    CERT/CC VINCE
  • Medium 6.1
    CVE-2026-35466

    Stored XSS via unsanitized input from remote service

    XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services

    CERT/CC cveClient/cveInterface.js
  • Medium 4.4
    CVE-2024-10469

    CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.

    VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.

    CERT/CC VINCE
  • Medium 4.9
    CVE-2024-9953

    Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8

    A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is ac…

    CERT/CC VINCE - Vulnerability Information and Coordination Environment