Skip to content
OpenAdvisories

Vendor

pawelmalak

3 known vulnerabilities.

Products

flame 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.0
    CVE-2026-100502

    Flame through 2.4.0 Admin Token Insufficient Session Expiration

    Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-…

    pawelmalak flame
  • Medium 6.5
    CVE-2026-100501

    Flame through 2.4.0 Brute-Force Attack via Login Endpoint

    Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guess…

    pawelmalak flame
  • Medium 5.3
    CVE-2026-100418

    Flame through 2.4.0 Information Exposure via GET /api/config

    Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational…

    pawelmalak flame