semaphore vulnerabilities

CVEs whose affected-version data names the semaphore package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-91994Medium· 6.5PoC

1w ago

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credenti…

▾ Twilightsemaphoreui · semaphoreEPSS 0.30%via NVD