{"kind": "product", "path": "vulns/pypi/vantage6", "name": "vantage6", "product": "vantage6", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-73652", "noindex": false, "published": "2026-08-13T18:15:55.367Z", "modified": "2026-08-13T18:57:28.520Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00351, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-73652", "title": "vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review", "description": "vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted for approval. No fixed version is available as of this review.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-47w6-gwp4-w6vc", "https://nvd.nist.gov/vuln/detail/CVE-2026-73652"], "fixes": [], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-54533", "noindex": false, "published": "2026-06-17T22:17:08.550Z", "modified": "2026-06-18T12:36:58.300Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00285, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-54533", "title": "vantage6 node has an Improper Access Control issue", "description": "vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms input and output files. Version 5.0.0 fixes the issue. As a workaround, verify and restrict the algorithm containers that are allowed to run on the node.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-x9f6-9rvm-mmrg", "https://github.com/vantage6/vantage6/issues/1932", "https://docs.vantage6.ai/usage/running-the-node/security"], "fixes": ["5.0.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-54445", "noindex": false, "published": "2026-06-17T22:14:51.461Z", "modified": "2026-06-18T15:49:54.097Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00292, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-54445", "title": "Vantage6: Set admin user and password from environment or configuration", "description": "vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the `root` user after it has been used to create other users.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4", "https://github.com/vantage6/vantage6/issues/1932", "https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500"], "fixes": ["5.0.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-27928", "noindex": false, "published": "2026-06-17T22:12:36.791Z", "modified": "2026-06-18T12:57:34.777Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00278, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-27928", "title": "Vantage6: 2FA can be circumvented with hacked email access", "description": "vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1) reset the password via email and then 2) reset the 2FA token via email. This way they reduce 2FA to 1FA (email access). Note that most email providers require 2FA to access email, so this issue is not very likely to cause issues. Version 5.0.0 fixes the issue. No known workarounds are available.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-4c5c-2vc3-x5w2", "https://github.com/vantage6/vantage6/issues/1932", "https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500"], "fixes": ["5.0.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-24769", "noindex": false, "published": "2026-06-17T22:07:59.310Z", "modified": "2026-06-18T12:43:29.340Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00278, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-24769", "title": "Vantage6: No limit on emails sent for password/MFA reset", "description": "vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam sender. Note resetting the MFA token requires a correct password, so the potential impact for this is very low. Version 5.0.0 fixes the issue. No known workarounds are available.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-5549-c5q7-fj65", "https://github.com/vantage6/vantage6/issues/1932", "https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500"], "fixes": ["5.0.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-43863", "noindex": false, "published": "2025-06-12T17:29:57.047Z", "modified": "2025-06-12T17:54:44.017Z", "cvss": 1.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U", "severity": "low", "epss": 0.00466, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-43863", "title": "vantage6 lacks brute-force protection on change password functionality", "description": "vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct. This vulnerability is fixed in 4.11.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-j6g5-p62x-58hw", "https://nvd.nist.gov/vuln/detail/CVE-2025-43863"], "fixes": ["4.11.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-32969", "noindex": false, "published": "2024-05-23T08:22:57.564Z", "modified": "2024-08-02T02:27:53.367Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00319, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-32969", "title": "vantage6 collaboration admins can extend their influence by expanding the collaboration", "description": "vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in.  This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.\n", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx", "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56", "https://nvd.nist.gov/vuln/detail/CVE-2024-32969"], "fixes": ["4.5.0rc3"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-23823", "noindex": false, "published": "2024-03-14T18:47:50.328Z", "modified": "2024-08-01T23:13:08.222Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00314, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-23823", "title": "CORS settings overly permissive in vantage6", "description": "vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server.  The impact is limited because v6 does not use session cookies. This issue has been addressed in commit `70bb4e1d8` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-4946-85pr-fvxh", "https://github.com/vantage6/vantage6/commit/70bb4e1d889230a841eb364d6c03accd7dd01a41", "https://nvd.nist.gov/vuln/detail/CVE-2024-23823"], "fixes": ["4.3.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-24770", "noindex": false, "published": "2024-03-14T18:47:46.804Z", "modified": "2024-08-26T15:21:53.399Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00397, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-24770", "title": "Username timing attack on recover password/MFA token in vantage6", "description": "vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes `/recover/lost` and `/2fa/lost`. These routes send emails to users if they have lost their password or MFA token. This issue has been addressed in commit `aecfd6d0e` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-5h3x-6gwf-73jm", "https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53", "https://github.com/vantage6/vantage6/commit/aecfd6d0e83165a41a60ebd52d2287b0217be26b"], "fixes": ["4.3.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-22193", "noindex": false, "published": "2024-01-30T15:50:09.928Z", "modified": "2025-06-17T13:44:50.458Z", "cvss": 3.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00257, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-22193", "title": "vantage6 unencrypted task can be created in encrypted collaboration", "description": "The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database.  Users should ensure they set the encryption setting correctly.  This vulnerability is patched in 4.2.0.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-rjmv-52mp-gjrr", "https://github.com/vantage6/vantage6/commit/6383283733b81abfcacfec7538dc4dc882e98074", "https://nvd.nist.gov/vuln/detail/CVE-2024-22193"], "fixes": ["4.2.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}, {"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-21671", "noindex": false, "published": "2024-01-30T15:43:06.789Z", "modified": "2024-10-17T18:01:07.740Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00401, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-21671", "title": "vantage6 username timing attack", "description": "The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).  It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks.  Version 4.2.0 patches this vulnerability.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53", "https://github.com/vantage6/vantage6/commit/389f416c445da4f2438c72f34c3b1084485c4e30", "https://nvd.nist.gov/vuln/detail/CVE-2024-21671"], "fixes": ["4.2.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-21653", "noindex": false, "published": "2024-01-30T15:39:30.554Z", "modified": "2024-08-23T18:23:40.114Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.0047, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-21653", "title": "vantage6 insecure SSH configuration for node and server containers", "description": "The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).  Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive.  The vulnerability can be mitigated by removing the ssh part from the docker file and rebuilding the docker image.  Version 4.2.0 patches the vulnerability.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-2wgc-48g2-cj5w", "https://github.com/vantage6/vantage6/commit/3fcc6e6a8bd1142fd7a558d8fdd2b246e55c8841", "https://nvd.nist.gov/vuln/detail/CVE-2024-21653"], "fixes": ["4.2.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-21649", "noindex": false, "published": "2024-01-30T15:33:03.404Z", "modified": "2025-05-29T15:05:10.990Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01266, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-21649", "title": "Remote code execution ", "description": "The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution.  This vulnerability is patched in 4.2.0.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-w9h2-px87-74vx", "https://github.com/vantage6/vantage6/commit/eac19db737145d3ca987adf037a454fae0790ddd", "https://nvd.nist.gov/vuln/detail/CVE-2024-21649"], "fixes": ["4.2.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}, {"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-41882", "noindex": false, "published": "2023-10-11T19:48:44.606Z", "modified": "2024-09-17T14:01:08.232Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00497, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-41882", "title": "vantage6 Improper Access Control vulnerability", "description": "vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r", "https://github.com/vantage6/vantage6/pull/711", "https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400"], "fixes": ["4.0.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-41881", "noindex": false, "published": "2023-10-11T19:30:43.808Z", "modified": "2024-09-17T14:02:51.483Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N", "severity": "low", "epss": 0.00354, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-41881", "title": "Deleting a collaboration should also delete linked resources", "description": "vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-rf54-7qrr-96j6", "https://github.com/vantage6/vantage6/pull/748", "https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400"], "fixes": ["4.0.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-28635", "noindex": false, "published": "2023-10-11T19:21:23.678Z", "modified": "2024-09-17T14:03:13.749Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00504, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-28635", "title": "Defining resource name as integer in vantage6 may give unintended access", "description": "vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for example, if user id 13 is allowed to run tasks, and an attacker creates a username with username '13', they would be wrongly allowed to run an algorithm. There may also be other places in the code where such a mixup of resource ID or name leads to issues. Version 4.0.0", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-7x94-6g2m-3hp2", "https://github.com/vantage6/vantage6/pull/744", "https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400"], "fixes": ["4.0.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-23930", "noindex": false, "published": "2023-10-11T17:39:23.504Z", "modified": "2024-09-18T15:22:09.610Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.01108, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-23930", "title": "vantage6's Pickle serialization is insecure", "description": "vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version 4.0.0 contains a patch. Users may specify JSON serialization as a workaround.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-5m22-cfq9-86x6", "https://github.com/vantage6/vantage6/commit/e62f03bacf2247bd59eed217e2e7338c3a01a5f0", "https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400"], "fixes": ["4.0.2"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}, {"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-23929", "noindex": false, "published": "2023-03-03T23:37:50.748Z", "modified": "2025-02-25T15:02:00.830Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00571, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-23929", "title": "Refresh tokens do not expire in Vantage6", "description": "vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.\n", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-4w59-c3gc-rrhp", "https://github.com/vantage6/vantage6/commit/48ebfca42359e9a6743e9598684585e2522cdce8", "https://nvd.nist.gov/vuln/detail/CVE-2023-23929"], "fixes": ["3.8.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}, {"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-22738", "noindex": false, "published": "2023-03-01T20:22:13.113Z", "modified": "2025-03-06T19:07:40.465Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.00375, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-22738", "title": "Improper Preservation of Permissions in vantage6", "description": "vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-vvjv-97j8-94xh", "https://github.com/vantage6/vantage6/commit/798aca1de142a4eca175ef51112e2235642f4f24", "https://nvd.nist.gov/vuln/detail/CVE-2023-22738"], "fixes": ["3.6.1", "3.8.0", "3.8.0rc3"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}, {"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-39228", "noindex": false, "published": "2023-03-01T16:23:18.720Z", "modified": "2025-03-07T21:24:48.813Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00596, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-39228", "title": "Observable Response Discrepancy in vantage6", "description": "vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.\n", "references": ["https://github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429", "https://github.com/vantage6/vantage6/issues/59", "https://github.com/vantage6/vantage6/pull/281"], "fixes": ["3.8.0"], "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}, {"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}]}], "total": 20, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "vantage6", "path": "vulns/pypi/vantage6", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-13T18:57:28.520Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}