Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-125362

Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Haiwen
Products
Seahub
CVE-2026-56768

Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method

Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Haiwen
Products
Seahub