decolua vulnerabilities

Newest CVEs

• CVE-2026-108593

  9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint

  decolua · 9router

  High7.3
• CVE-2026-103530

  decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

  decolua · 9Router

  Medium6.9
• CVE-2026-56682

  9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

  decolua · 9router

  Medium5.3
• CVE-2026-56681

  9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

  decolua · 9router

  High7.3
• CVE-2026-72860

  9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

  decolua · 9router

  Medium6.3
• CVE-2026-56677

  9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

  decolua · 9router

  High8.6
• CVE-2026-63732

  9router before 0.4.60 Remote Code Execution via default password

  decolua · 9router

  Critical9.4
• CVE-2026-63313

  9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch

  decolua · 9router

  High8.3
• CVE-2026-62312

  9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments

  decolua · 9router

  High8.8
• CVE-2026-56678

  9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

  decolua · 9router

  Medium6.4