These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
TREK collaborative travel planner has a vulnerability in the get_trip_summary tool, allowing unauthorized access to trip metadata and third-party contact information. The issue is fixed in version 3.3.0. This vulnerability enables MCP clients with unrelated capabilities to receive trip metadata, member email addresses, itinerary days, and accommodations for every trip accessible to the token's user. Cross [truncated]
TREK collaborative travel planner, prior to version 3.3.0, improperly shares trip data through a GET request to /api/shared/:token, even when the trip owner has disabled map sharing. The response includes sensitive information such as itinerary, place names, coordinates, addresses, descriptions, notes, and prices. This issue allows anyone with a valid share token to access location and route information t [truncated]
CVE-2026-77294 is a vulnerability in TREK, a collaborative travel planner, that allows an authenticated user to store an attacker-controlled URL through the settings API when the LLM_PARSING feature is enabled. This can lead to internal service discovery and access to link-local cloud metadata, potentially disclosing infrastructure credentials and allowing modification of protected cloud resources.
CVE-2026-77293 is a vulnerability in TREK, a collaborative travel planner, that allows an authenticated user to delete note-file attachments belonging to another user's trip. The issue is fixed in version 3.3.0. This vulnerability enables an attacker to permanently delete note-file attachments without requiring the file to belong to their trip, potentially disrupting collaborative travel plans. Defenders [truncated]
TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST [truncated]
CVE-2026-54509 debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T22:17:21.553Z and has not been modified since then. The vulnerability affects TREK versions from 3.0.0 to 3.1.0, allowing authenticated users to access shared journey data without permission. This issue is fixed in version 3.1.0. Defenders should assess exposure and prioritize upgrading to prevent unauth [truncated]
CVE-2026-54508 is a vulnerability in TREK, a collaborative travel planner, that allows an attacker to perform blind GET requests to internal services without response-body reflection. The issue arises from the application's validation of only the initial URL before native redirect following in certain functions, which can lead to SSRF attacks. This vulnerability is fixed in version 3.1.0.
CVE-2026-54505 is a low-severity vulnerability in the TREK travel planner that allows for content spoofing and UI redress when the Journey add-on is enabled. The issue is fixed in version 3.1.0. Defenders should assess exposure and prioritize upgrading to version 3.1.0. The vulnerability arises from the interpolation of unescaped activeSuggestion.title values into journey.frontpage.suggestionText, which i [truncated]
TREK collaborative travel planner versions prior to 3.0.18 contain a user enumeration vulnerability via timing side-channel. The login endpoint exhibits a measurable latency difference (~370 ms vs ~10 ms) based on whether a submitted email address exists in the database, caused by bcrypt password comparison being performed only for valid users. This ~14× timing discrepancy allows remote attackers to enume [truncated]
