Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 5 total.
API impersonation and missing object-level authorization in dataCycle-CORE (CVE-2026-32821)
In dataCycle-CORE, any authenticated API user can supply a `user_email` parameter to the collection API to evaluate permissions as a different user, potentially exposing that user's collections. In V4, the same contro...
Fixed in 26.06.08
Path traversal in dataCycle-CORE markdown renderer (CVE-2026-32820)
The documentation and static markdown renderer in dataCycle-CORE accepts attacker-controlled path segments and processes them only through the Rails HTML sanitizer, which does not strip directory traversal sequences. ...
Fixed in 26.06.08
Open redirect in dataCycle-CORE password reset and confirmation flows (CVE-2026-32824)
A low-privileged authenticated API user can supply attacker-controlled `forwardToUrl` and `redirectUrl` parameters when triggering password reset or account confirmation flows in dataCycle-CORE. These values are embed...
Fixed in 26.06.08
Brute-force protection bypass on login endpoints in dataCycle-CORE (CVE-2026-32825)
dataCycle-CORE versions up to and including 25.07.3 accept unlimited password guesses against both the browser login endpoint (`/users/sign_in`) and the JSON API login endpoint (`/api/v4/auth/login`). Although Devise'...
Fixed in 26.06.08
Unauthorized text file download via DataLink in dataCycle-CORE (CVE-2026-32807)
dataCycle-CORE contains a public route for downloading DataLink-attached text files that does not enforce link validity, expiry, or caller authentication. Any party in possession of a DataLink UUID - including recipie...
Fixed in 26.06.08