CERT/CC vulnerabilities
We track 3 vulnerabilities in CERT/CC products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 12, 2026.
Latest CERT/CC vulnerabilities
- 9.8 Critical severity
VINCE: Authorization Bypass Through User-Controlled Key
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks
- 7.5 High severity
cveClient/encrypt-storage.js: Insufficiently Protected Credentials
The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.
- 8.8 High severity
VINCE - The Vulnerability Information and…: Deserialization of Untrusted Data
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.