CodeAnt AI Vulnerability Database
A comprehensive hub for tracking high-impact vulnerabilities across application code and third-party libraries, for security teams and developers.
CVE-2026-30861
(9.9)
Command Injection in MCP Stdio Configuration Validation (CWE-78) in WeKnora
Remote Code Execution
CVE-2026-30860
(9.9)
SQL Injection via PostgreSQL Array/Row Expressions (CWE-89) in WeKnora Query Engine
Remote Code Execution via SQL Injection on the Database Server
CVE-2026-30855
(8.8)
Authorization Bypass in Tenant Management (CWE-284) in WeKnora
Cross-Tenant Account Takeover and Data Destruction
CVE-2026-30851
(8.1)
Improper Authentication via Header Injection (CWE-287) in Caddy forward_auth copy_headers
Authentication Bypass and Privilege Escalation via Trust of Spoofed Identity Headers
CVE-2026-30834
(7.5)
Server-Side Request Forgery (CWE-918) in PinchTab /download Endpoint
Internal Network and Local File/Data Exposure via SSRF
CVE-2026-30832
(9.1)
Server-Side Request Forgery (CWE-918) via LFS Endpoint in Soft Serve Git Server
Internal network access and data exfiltration via SSRF
CVE-2026-29784
(7.5)
Incomplete CSRF Protection (CWE-352) in Ghost Session Verification Endpoint
Account Takeover / Site Compromise
CVE-2026-29779
(7.5)
Sensitive Configuration Exposure (CWE-200) in UptimeFlare Client Bundle
Disclosure of Sensitive Configuration Data
CVE-2026-29778
(7.1)
Path Traversal (CWE-23) in pyLoad edit_package Folder Handling
Arbitrary File System Access Within Application Privileges
CVE-2026-28678
(8.1)
Insufficiently Protected Authentication Tokens (CWE-522) in DSA Study Hub Auth Flow
Account Takeover and Session Abuse
