Morpheus65535 vulnerabilities
We track 3 vulnerabilities in Morpheus65535 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Morpheus65535 vulnerabilities
- 10.0 Critical severity
bazarr: Cross-Site Request Forgery
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook com
- 7.5 High severity
bazarr: Improper Limitation of a Pathname to a Restricted Directory
Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. T
- 7.5 High severity
bazarr: Improper Limitation of a Pathname to a Restricted Directory
Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads t