CRITICAL
UTMStack Authentication Bypass
Unauthenticated API access via static Internal API Key header bypass
Coming soonCVE record
CVEs/VULNERABILITIES/RESPONSIBLE DISCLOSURE
Published CVE
discoveries.
Vulnerabilities I've discovered and responsibly disclosed to help secure widely-used software.
14CVEs Published
4Products Affected
100%Disclosed
$ cve --summary
- TOTAL
- 14
- CRITICAL
- 6
- HIGH
- 7
- AVG CVSS
- 7.9
- MAX CVSS
- 9.8
Critical 6High 7
$ tail -n 2 disclosures.log
2026-09-21 [PUBLISHED] CVE-2026-82042
2026-09-21 [PUBLISHED] CVE-2026-82041
$
Research Stats
UPDATED SEP 2026Total CVEs14across 4 products
Critical643% of findings
High750% of findings
Average CVSS7.9peak 9.8
Unauthenticated2no login required
Disclosure Rate100%all patched & public
All CVEs
14 RESULTS/
CRITICAL
CVE-2026-82041UTMStack
UTMStack WebSocket RCE
Remote Command Execution via Incident Response WebSocket endpoint
Coming soonCVE record
CRITICAL
rConfig Unauthorized Admin Registration
Unauthenticated Admin Account Creation via Duplicate Auth Routes
CRITICAL
CVE-2026-80138ClipBucket V5
ClipBucket V5 OS Command Injection
OS Command Injection via Installer php_cli_filepath Parameter
CRITICAL
CVE-2026-77929ClipBucket V5
ClipBucket V5 File Upload RCE
Arbitrary PHP File Upload to RCE via Extension/MIME Validation Mismatch
HIGH
CVE-2026-82039UTMStack
UTMStack SQL Injection
Time-based Blind SQL Injection in Asset Groups Search endpoint
CRITICAL
CVE-2026-86751Snipe-IT
Snipe-IT SSRF & File Disclosure
Arbitrary File Read and SSRF via Acceptance Note Markdown Injection
HIGH
CVE-2026-82040UTMStack
UTMStack SSRF in IdP Config
Server-Side Request Forgery via Identity Provider metadata URL validation
Coming soonCVE record
HIGH
CVE-2026-82044UTMStack
UTMStack SSRF in PDF Export
Server-Side Request Forgery via PDF generation endpoint URL parameter
Coming soonCVE record
HIGH
CVE-2026-82045UTMStack
UTMStack JPQL Injection
JPQL Injection in Network Scan property search via String.format()
Coming soonCVE record
HIGH
CVE-2026-77928ClipBucket V5
ClipBucket V5 PM Deletion SQLi
Blind SQL Injection in Private Message Deletion via Array Parameter Bypass
HIGH
CVE-2026-77927ClipBucket V5
ClipBucket V5 Photo Deletion SQLi
Blind SQL Injection in Photo Deletion via Array Parameter Bypass
HIGH
LOW
CVE-2026-82043UTMStack
UTMStack Account Enumeration
Account enumeration via differential password reset error responses
Coming soonCVE record
Disclosure Process
- 01
Discover
Manual code review and black-box testing of widely deployed software.
- 02
Verify
Build a reliable proof of concept and score impact with CVSS 3.1.
- 03
Report
Private disclosure to the vendor with full technical detail.
- 04
Patch
Work with maintainers until a fixed release ships.
- 05
Publish
CVE assigned and a full writeup released for defenders.
$ ./disclose.sh --vendor
Are you a vendor?
If one of these issues affects your product or you'd like a security review before release, get in touch.