What’s Vulnerable › Products

mauriceboe TREK vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your mauriceboe TREK version is affected

Latest mauriceboe TREK vulnerabilities

• CVE-2026-77321 — TREK MCP trip summary bypasses delegated OAuth read scopes (CVSS 4.3)
• CVE-2026-77320 — TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure) (CVSS 5.3)
• CVE-2026-77294 — TREK: Server-Side Request Forgery via User-Configurable LLM Base URL (CVSS 8.1)
• CVE-2026-77293 — TREK: Cross-user note-file deletion (IDOR / Broken Access Control) (CVSS 7.1)
• CVE-2026-62945 — TREK: Cross-trip reservation title disclosure via file links (CVSS 4.3)
• CVE-2026-54509 — TREK IDOR: any authenticated user can read another user's journey share token (full journey leak) (CVSS 6.5)
• CVE-2026-54508 — TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution (CVSS 5.3)
• CVE-2026-54505 — TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner (CVSS 2.0)
• CVE-2026-45410 — Time-based user enumeration in TREK authentication endpoint (CVSS 5.3)
• CVE-2026-40185 — Missing Authorization on Immich Trip Photo Routes in TREK (CVSS 6.5)
• CVE-2026-40184 — Unauthenticated Access to Uploaded Files in TREK (CVSS 5.3)