mauriceboe TREK

• CVE-2026-77293 High 7.1 TREK: Cross-user note-file deletion (IDOR / Broken Access Control) 0.4%
• CVE-2026-77320 Medium 5.3 TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure) 0.3%
• CVE-2026-77321 Medium 4.3 TREK MCP trip summary bypasses delegated OAuth read scopes 0.2%
• CVE-2026-77294 High 8.1 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL 0.3%
• CVE-2026-62945 Medium 4.3 TREK: Cross-trip reservation title disclosure via file links 0.3%
• CVE-2026-54509 Medium 6.5 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak) 0.4%
• CVE-2026-54508 Medium 5.3 TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution 0.4%
• CVE-2026-54505 Low 2.0 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner 0.6%
• CVE-2026-45410 Medium 5.3 Time-based user enumeration in TREK authentication endpoint 0.2%
• CVE-2026-40185 High 7.1 Missing Authorization on Immich Trip Photo Routes in TREK 0.2%
• CVE-2026-40184 Low 3.7 Unauthenticated Access to Uploaded Files in TREK 0.2%