M
Vendor security profile
mauriceboe
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs8
Critical0
CISA KEV0
Public exploit5
Patch rate%0
Avg. CVSS5.4
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
4
4
0
CVE KEV
CVE severity distribution
8toplam CVE
High2 (25%)
Medium5 (63%)
Low1 (13%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%63
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
8Unknown
Latest vulnerabilities
7.1
CVE-2026-77293
TREK: Cross-user note-file deletion (IDOR / Broken Access Control)
M
Patch status unknownEPSS %0
5.3
CVE-2026-77320
TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)
M
Patch status unknownEPSS %0
4.3
CVE-2026-77321
TREK MCP trip summary bypasses delegated OAuth read scopes
M
Patch status unknownEPSS %0
8.1
CVE-2026-77294
TREK: Server-Side Request Forgery via User-Configurable LLM Base URL
M
Patch status unknownEPSS %0
4.3
CVE-2026-62945
TREK: Cross-trip reservation title disclosure via file links
M
Patch status unknownEPSS %0
6.5
CVE-2026-54509
TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
M
Patch status unknownEPSS %0
5.3
CVE-2026-54508
TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
M
Patch status unknownEPSS %0
2.0
CVE-2026-54505
TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner
M
Patch status unknownEPSS %1