CIRCL vulnerabilities
We track 3 vulnerabilities in CIRCL products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on December 8, 2025.
Latest CIRCL vulnerabilities
- 8.3 High severity
Vulnerability-Lookup: Improper Neutralization of Input During Web Page Generation
In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting (XSS). On the backend, the related_vulnerabilities field of bundles accepted arbitrary strings
- 7.0 High severity
Vulnerability-Lookup: Cross-Site Request Forgery
Some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or other privileged actions) may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the
- 8.1 High severity
Vulnerability-Lookup: Improper Restriction of Excessive Authentication Attempts
In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary numbe