cve.bz

tianma-if edgeever vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 5.1CVE-2026-129172

    EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without chec…

  2. 8.4CVE-2026-109559EPSS 0.3%

    EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-ser…

  3. 8.5CVE-2026-109558EPSS 0.4%

    EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates co…

  4. 8.4CVE-2026-109557EPSS 0.4%

    EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, re…

  5. 7.3CVE-2026-109556EPSS 0.7%

    EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in …

  6. 5.3CVE-2026-108727EPSS 0.3%

    EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. At…