Name	SBA Research Cookie
Provider	SBA Research
Purpose	Saves the settings of the visitors selected in the cookie box.
Cookie name	sba-research-cookie
Cookie runtime	1 year

Name	YouTube
Provider	YouTube
Purpose	Used to unblock YouTube content.
Privacy policy	https://policies.google.com/privacy
Host(s)	google.com
Cookie name	NID
Cookie runtime	6 months

Name	Vimeo
Provider	Vimeo
Purpose	Used to unblock Vimeo content.
Privacy policy	https://vimeo.com/privacy
Host(s)	player.vimeo.com
Cookie name	vuid
Cookie runtime	2 years

SBA Security Advisory – SWUpdate Untrusted Script Execution via Signed Update TOCTOU (CVE-2025-41259)

June 3, 2026

SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update. Read More

SBA Security Advisory – DFIR-IRIS Alerts Can be Falsely Attributed to Customers (CVE-2026-42547)

May 19, 2026

Users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Read More

SBA Security Advisory – DFIR-IRIS Cross-Site Request Forgery (CSRF) (CVE-2026-42543)

May 19, 2026

The IRIS web application is vulnerable to a Cross-site request forgery attack, because it uses the HTTP method GET to change state on the server. Read More

SBA Security Advisory – DFIR-IRIS Mass Assignment (CVE-2026-42540)

May 19, 2026

he IRIS web application allows a user to alter values in the database via manipulated API requests. Read More

SBA Security Advisory – DFIR-IRIS Excessive Data Exposure (CVE-2026-42439)

May 19, 2026

The IRIS web application returns sensitive data to the user which are not required for the client’s operation. Read More

SBA Security Advisory – DFIR-IRIS Insecure File Upload (CVE-2026-42538)

May 19, 2026

The IRIS web application does not properly validate uploaded files. It can therefore be misused to host phishing pages, amongst other things. This also creates an instance of a Cross-Site Scripting (XSS) vulnerability. Read More

SBA Security Advisory – DFIR-IRIS Open Redirect (CVE-2026-42329)

May 19, 2026

The IRIS web application contains a weakness where an attacker can misuse it to redirect the user to a malicious website controlled by an attacker. Read More

SBA Security Advisory – GoAnywhere MFT Email HTML Injection (CVE-2026-0972)

April 24, 2026

GoAnywhere MFT before 7.10.0 is affected by an HTML injection vulnerability in its email templating functionality. If an attacker is able to influence the content of a template variable, malicious HTML can be embedded into outgoing emails generated by the application. As these messages originate from a trusted system, the vulnerability may facilitate phishing and other social-engineering attacks. The issue arises from insufficient HTML encoding of untrusted input before inclusion in HTML email content. Read More

SBA Security Advisory – LibreChat RAG API Authentication Bypass (CVE-2025-41258)

March 18, 2026

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API. ... Read More

SBA Security Advisory – Checkmk Cross Site Scripting (CVE-2025-64999)

March 5, 2026

Checkmk in versions before 2.4.0p22 and 2.3.0p43 is prone to a cross-site scripting (XSS) vulnerability when used in a distributed monitoring setup. Any connected remote site can inject JavaScript code in the central site's user interface. ... Read More

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Tag: Security Advisory

SBA Security Advisory – SWUpdate Untrusted Script Execution via Signed Update TOCTOU (CVE-2025-41259)

SBA Security Advisory – DFIR-IRIS Alerts Can be Falsely Attributed to Customers (CVE-2026-42547)

SBA Security Advisory – DFIR-IRIS Cross-Site Request Forgery (CSRF) (CVE-2026-42543)

SBA Security Advisory – DFIR-IRIS Mass Assignment (CVE-2026-42540)

SBA Security Advisory – DFIR-IRIS Excessive Data Exposure (CVE-2026-42439)

SBA Security Advisory – DFIR-IRIS Insecure File Upload (CVE-2026-42538)

SBA Security Advisory – DFIR-IRIS Open Redirect (CVE-2026-42329)

SBA Security Advisory – GoAnywhere MFT Email HTML Injection (CVE-2026-0972)

SBA Security Advisory – LibreChat RAG API Authentication Bypass (CVE-2025-41258)

SBA Security Advisory – Checkmk Cross Site Scripting (CVE-2025-64999)

Upcoming events @ SBA

SBA Research at a glance

Highlights of the past years:

Privacy settings

SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.

Tag: Security Advisory

Highlights of the past years:

SBA Research is a research center for Information Security
funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.