xyproto vulnerabilities

Newest CVEs

• CVE-2026-52792

  Algernon: Server-side script source disclosure on Windows via NTFS filename

  xyproto · algernon

  High8.7
• CVE-2026-48126

  Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

  xyproto · algernon

  High8.2
• CVE-2026-46431

  Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

  xyproto · algernon

  Medium4.3
• CVE-2026-46430

  Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

  xyproto · algernon

  Medium4.3
• CVE-2026-45728

  Algernon: Single-file mode unconditionally enables debug mode

  xyproto · algernon

  High7.5
• CVE-2026-45721

  Algernon: handler.lua discovery walks parent directories above the server root

  xyproto · algernon

  Critical9.0
• CVE-2026-43981

  Algernon: Race Condition in handle() shared LState

  xyproto · algernon

  High8.2
• CVE-2026-43982

  Algernon: Path traversal file write via savein()

  xyproto · algernon

  High8.7