cve.bz

cervantessec cervantes vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 8.7CVE-2026-129427

    Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges

  2. 4.3CVE-2026-115998EPSS 0.2%

    IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify findin…

  3. 5.4CVE-2026-115994EPSS 0.2%

    BOLA Allows Cross-Project Target Tampering  in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, result…

  4. 6.8CVE-2026-115993EPSS 0.3%

    Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges

  5. 7.1CVE-2026-115975EPSS 0.2%

    Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects

  6. 5.4CVE-2024-42055EPSS 0.4%

    Cervantes through 0.5-alpha allows stored XSS.

  7. 5.4CVE-2024-42054EPSS 0.4%

    Cervantes through 0.5-alpha accepts insecure file uploads.