Sync-in server vulnerabilities
6 published CVEs name Sync-in server among the affected products.
- 6Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 0Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-58272
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Sync-in · server
Medium5.3 - CVE-2026-58270
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
Sync-in · server
Medium6.5 - CVE-2026-58269
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
Sync-in · server
High8.1 - CVE-2026-58271
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
Sync-in · server
Medium6.8 - CVE-2026-47684
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
Sync-in · server
High7.7 - CVE-2026-41161
Username Enumeration via Timing Attack
Sync-in · server
Medium6.9