EQSTLab

12 credited records · 12 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-101062No exploit	Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registrationobot-platform · obot · CWE-863 Pre-auth Auth bypass Broken access control (IDOR)	High8.7	—	0.3%	Sep 27, 2026
28Monitor	CVE-2026-101059No exploit	utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypassuniversal-tool-calling-protocol · python-utcp · CWE-918 Pre-auth SSRF	High7.1	—	0.2%	Sep 27, 2026
28Monitor	CVE-2026-101058No exploit	python-utcp before 1.1.12 SSRF via Remote HTTP Manualuniversal-tool-calling-protocol · python-utcp · CWE-918 Pre-auth SSRF	High7.1	—	0.2%	Sep 27, 2026
28Monitor	CVE-2026-90933No exploit	laradashboard through 1.2.2 Missing Authorization via License APIlaradashboard · laradashboard · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Sep 14, 2026
30Monitor	CVE-2026-85124No exploit	@fastify/http-proxy vulnerable to prefix escape via backslash dot-segmentsfastify · fastify\/http-proxy · CWE-22 Pre-auth Path traversal	High7.5	—	0.7%	Sep 3, 2026
30Monitor	CVE-2026-75759No exploit	Encrypted ID token or JARM response accepted without a nested signature in erlef oidccerlef · oidcc · CWE-347 Pre-auth Weak crypto	High7.6	—	0.2%	Aug 29, 2026
32Monitor	CVE-2026-16231No exploit	hbs vulnerable to XSS via registerAsyncHelper output-escaping bypasshbs project · hbs · CWE-79 Pre-auth XSS	High8.1	—	0.2%	Aug 25, 2026
30Monitor	CVE-2026-65633No exploit	Purpose-limited JWT accepted as full bearer authentication in AshAuthenticationteam-alembic · ash_authentication · CWE-287 Pre-auth Auth bypass	High7.6	—	0.6%	Aug 25, 2026
33Monitor	CVE-2026-76225No exploit	ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSVarcadedata · arcadedb · CWE-918 SSRF	High8.3	—	0.4%	Aug 19, 2026
36Monitor	CVE-2026-18248No exploit	@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event headerfastify · fastify\/aws-lambda · CWE-345 Pre-auth	Critical9.1	—	0.4%	Aug 3, 2026
35Monitor	CVE-2026-64623No exploit	Network-AI before 5.13.4 Cryptographic Signature Verification Bypassjovancoding · network-ai · CWE-347 Pre-auth Weak crypto	High8.8	—	0.3%	Jul 20, 2026
37Monitor	CVE-2026-62241No exploit	clawvet < 0.7.5 Hard-coded JWT Secret Session Forgerymohibshaikh · clawvet · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.7%	Jul 16, 2026

CVE-2026-101062
34Monitor
Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration
HighCVSS 8.7No exploitEPSS 0%
obot-platform · obotSep 27, 2026
CVE-2026-101059
28Monitor
utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SSRF
universal-tool-calling-protocol · python-utcpSep 27, 2026
CVE-2026-101058
28Monitor
python-utcp before 1.1.12 SSRF via Remote HTTP Manual
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SSRF
universal-tool-calling-protocol · python-utcpSep 27, 2026
CVE-2026-90933
28Monitor
laradashboard through 1.2.2 Missing Authorization via License API
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
laradashboard · laradashboardSep 14, 2026
CVE-2026-85124
30Monitor
@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Path traversal
fastify · fastify\/http-proxySep 3, 2026
CVE-2026-75759
30Monitor
Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Weak crypto
erlef · oidccAug 29, 2026
CVE-2026-16231
32Monitor
hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- XSS
hbs project · hbsAug 25, 2026
CVE-2026-65633
30Monitor
Purpose-limited JWT accepted as full bearer authentication in AshAuthentication
HighCVSS 7.6No exploitEPSS 1%
- Pre-auth
- Auth bypass
team-alembic · ash_authenticationAug 25, 2026
CVE-2026-76225
33Monitor
ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV
HighCVSS 8.3No exploitEPSS 0%
- SSRF
arcadedata · arcadedbAug 19, 2026
CVE-2026-18248
36Monitor
@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
fastify · fastify\/aws-lambdaAug 3, 2026
CVE-2026-64623
35Monitor
Network-AI before 5.13.4 Cryptographic Signature Verification Bypass
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
jovancoding · network-aiJul 20, 2026
CVE-2026-62241
37Monitor
clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Auth bypass
mohibshaikh · clawvetJul 16, 2026