Name	SBA Research Cookie
Provider	SBA Research
Purpose	Saves the settings of the visitors selected in the cookie box.
Cookie name	sba-research-cookie
Cookie runtime	1 year

Name	YouTube
Provider	YouTube
Purpose	Used to unblock YouTube content.
Privacy policy	https://policies.google.com/privacy
Host(s)	google.com
Cookie name	NID
Cookie runtime	6 months

Name	Vimeo
Provider	Vimeo
Purpose	Used to unblock Vimeo content.
Privacy policy	https://vimeo.com/privacy
Host(s)	player.vimeo.com
Cookie name	vuid
Cookie runtime	2 years

SBA Security Advisory – GoAnywhere MFT Email HTML Injection (CVE-2026-0972)

April 24, 2026

GoAnywhere MFT before 7.10.0 is affected by an HTML injection vulnerability in its email templating functionality. If an attacker is able to influence the content of a template variable, malicious HTML can be embedded into outgoing emails generated by the application. As these messages originate from a trusted system, the vulnerability may facilitate phishing and other social-engineering attacks. The issue arises from insufficient HTML encoding of untrusted input before inclusion in HTML email content. Read More

SBA Security Advisory – LibreChat RAG API Authentication Bypass (CVE-2025-41258)

March 18, 2026

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API. ... Read More

SBA Security Advisory – Checkmk Cross Site Scripting (CVE-2025-64999)

March 5, 2026

Checkmk in versions before 2.4.0p22 and 2.3.0p43 is prone to a cross-site scripting (XSS) vulnerability when used in a distributed monitoring setup. Any connected remote site can inject JavaScript code in the central site's user interface. ... Read More

SBA Security Advisory – Suprema BioStar 2 Insecure Password Change (CVE-2025-41257)

March 5, 2026

Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise. ... Read More

SBA Security Advisory – LibreChat Server-Side Request Forgery (CVE-2025-69222)

January 8, 2026

LibreChat version 0.8.1-rc2 is prone to a server-side request forgery (SSRF) vulnerability due to missing restrictions of the Actions feature in the default configuration. This allows attackers to interact with arbitrary third-party HTTP services, for example the internal RAG API. ... Read More

SBA Security Advisory – LibreChat Insufficient Access Control on Agent Files (CVE-2025-69220)

January 8, 2026

LibreChat version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. ... Read More

SBA Security Advisory – LibreChat Insufficient Access Control on Agent Permission Queries (CVE-2025-69221)

January 8, 2026

LibreChat version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. ... Read More

SBA Security Advisory – Checkmk Cross Site Scripting (CVE-2025-39663)

October 30, 2025

Checkmk in versions before 2.4.0p14 and 2.3.0p39, as well as in branches 2.2.0, 2.1.0 and 2.0.0 is prone to a Stored Cross-Site Scripting (XSS) vulnerability when used in a distributed monitoring setup. Any connected remote site can inject JavaScript code in the central site's user interface. ... Read More

SBA Security Advisory – Checkmk Agent Privilege Escalation via Insecure Temporary Files (CVE-2025-32919)

October 13, 2025

Vulnerability Overview The `win_license` plugin as included in Checkmk agent for Windows versions before 2.4.0p13, 2.3.0p38 and 2.2.0p46, as well as since version 2.1.0b2 and 2.0.0p28 allows low privileged users to escalate privileges to Local System due to insecure use of a temporary folder. Recommended… Read More

SBA Security Advisory – Checkmk Path Traversal (CVE-2025-39664)

October 13, 2025

Vulnerability Overview Checkmk in versions before 2.4.0p13, 2.3.0p38 and 2.2.0p46, as well as since version 2.1.0b1 is prone to a path traversal vulnerability in the report scheduler. Due to an insufficient validation of a file name input, users can store reports in arbitrary locations on the server. Read More

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Tag: Security Advisory

SBA Security Advisory – GoAnywhere MFT Email HTML Injection (CVE-2026-0972)

SBA Security Advisory – LibreChat RAG API Authentication Bypass (CVE-2025-41258)

SBA Security Advisory – Checkmk Cross Site Scripting (CVE-2025-64999)

SBA Security Advisory – Suprema BioStar 2 Insecure Password Change (CVE-2025-41257)

SBA Security Advisory – LibreChat Server-Side Request Forgery (CVE-2025-69222)

SBA Security Advisory – LibreChat Insufficient Access Control on Agent Files (CVE-2025-69220)

SBA Security Advisory – LibreChat Insufficient Access Control on Agent Permission Queries (CVE-2025-69221)

SBA Security Advisory – Checkmk Cross Site Scripting (CVE-2025-39663)

SBA Security Advisory – Checkmk Agent Privilege Escalation via Insecure Temporary Files (CVE-2025-32919)

SBA Security Advisory – Checkmk Path Traversal (CVE-2025-39664)

Upcoming events @ SBA

SBA Research at a glance

Highlights of the past years:

Privacy settings

SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Tag: Security Advisory

Highlights of the past years:

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.