Sync-in has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was September 2026 with 4. The median CVSS is 6.7 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.7
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Weakness classes
Products
- server 4
Worst active — by depth score
CVE-2026-58269High· 8.1Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing57CVE-2026-58271Medium· 6.8Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing49CVE-2026-58270Medium· 6.5Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing48CVE-2026-58272Medium· 5.3Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing41
Sync-in vulnerabilities
CVEs affecting Sync-in, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-58272Medium· 5.3PoCSync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accou…
CVE-2026-58270Medium· 6.5PoCSync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic…
CVE-2026-58269High· 8.1PoCSync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full a…
CVE-2026-58271Medium· 6.8PoCSync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOT…