rexpository

41 credited records · 41 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
38Monitor	CVE-2026-100721Proof of concept	vm2 before 3.12.2 Authorization Bypass via Custom Resolverpatriksimek · vm2 · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.5	—	0.4%	3 days ago
27Monitor	CVE-2026-100723No exploit	vm2 before 3.12.2 Memory Disclosure via zlib Buffer Poolpatriksimek · vm2 · CWE-200 Pre-auth Info leak	Medium6.9	—	0.3%	3 days ago
35Monitor	CVE-2026-100722No exploit	vm2 before 3.12.2 Host Process Termination via Construct Trappatriksimek · vm2 · CWE-248 Pre-auth	High8.9	—	0.3%	3 days ago
34Monitor	CVE-2026-100664No exploit	Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusionnetty · netty · CWE-20 Pre-auth	High8.7	—	0.3%	3 days ago
34Monitor	CVE-2026-100663No exploit	Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3netty · netty · CWE-20 Pre-auth	High8.7	—	0.3%	3 days ago
33Monitor	CVE-2026-100653No exploit	vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagationvllm-project · vllm · CWE-348 Pre-auth	High8.3	—	0.3%	3 days ago
32Monitor	CVE-2026-100652No exploit	vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_idsvllm-project · vllm · CWE-20 Pre-auth	High8.2	—	0.3%	3 days ago
28Monitor	CVE-2026-100651No exploit	vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypassvllm-project · vllm · CWE-400 Denial of service	High7.1	—	0.3%	3 days ago
34Monitor	CVE-2026-100640No exploit	SiYuan before v3.8.4 Clipboard Data Disclosure via IPCsiyuan-note · siyuan · CWE-200 Info leak	High8.6	—	0.2%	3 days ago
34Monitor	CVE-2026-100639No exploit	SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IALsiyuan-note · siyuan · CWE-79 Pre-auth XSS	High8.6	—	0.5%	3 days ago
32Monitor	CVE-2026-100635No exploit	SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookiesiyuan-note · siyuan · CWE-319 Pre-auth Auth bypass Weak crypto	High8.2	—	0.3%	3 days ago
34Monitor	CVE-2026-100665No exploit	Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypassnetty · netty · CWE-295 Pre-auth Weak crypto	High8.7	—	0.3%	4 days ago
34Monitor	CVE-2026-100641No exploit	SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Contentsiyuan-note · siyuan · CWE-79 RCE XSS	High8.6	—	0.5%	4 days ago
21Monitor	CVE-2026-100634No exploit	SiYuan before v3.8.4 Missing Authorization via siyuan-send-windowssiyuan-note · siyuan · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.5%	4 days ago
30Monitor	CVE-2026-100598No exploit	OpenClaw before 2026.7.1 Approval Binding Logic Erroropenclaw · openclaw · CWE-346	High7.5	—	0.1%	4 days ago
21Monitor	CVE-2026-100591No exploit	OpenClaw before 2026.7.1 Authentication Bypass via Active Memoryopenclaw · openclaw · CWE-862 Auth bypass Broken access control (IDOR)	Medium5.3	—	0.2%	4 days ago
21Monitor	CVE-2026-100590No exploit	OpenClaw before 2026.7.1 Authorization Bypass via voice setopenclaw · openclaw · CWE-863 Broken access control (IDOR)	Medium5.3	—	0.2%	4 days ago
21Monitor	CVE-2026-100592No exploit	OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreamingopenclaw · openclaw · CWE-862 Auth bypass Broken access control (IDOR)	Medium5.3	—	0.2%	4 days ago
27Monitor	CVE-2026-100527No exploit	OpenClaw before 2026.8.2 Denial of Service via Browser Relayopenclaw · openclaw · CWE-400 Pre-auth Denial of service	Medium6.9	—	0.3%	4 days ago
27Monitor	CVE-2026-93604No exploit	vm2 3.11.8 Sandbox Escape via crypto.setFipspatriksimek · vm2 · CWE-284 Pre-auth Broken access control (IDOR)	Medium6.9	—	0.3%	Sep 18, 2026
33Monitor	CVE-2026-92958No exploit	vm2 before 3.11.7 Denylist Bypass via fs/promisespatriksimek · vm2 · CWE-269	High8.4	—	0.4%	Sep 17, 2026
36Monitor	CVE-2026-92954No exploit	vm2 3.10.0 through 3.11.7 Denial of Service via Host Promisepatriksimek · vm2 · CWE-248 Pre-auth	Critical9.2	—	0.5%	Sep 17, 2026
37Monitor	CVE-2026-92953No exploit	vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArraypatriksimek · vm2 · CWE-913 Pre-auth Prototype pollution	Critical9.3	—	0.5%	Sep 17, 2026
35Monitor	CVE-2026-92952No exploit	vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypasspatriksimek · vm2 · CWE-669 Pre-auth	High8.9	—	0.5%	Sep 17, 2026
8Monitor	CVE-2026-86424No exploit	ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Raceimagemagick · imagemagick · CWE-59 Path traversal Race condition	Low2.0	—	0.1%	Sep 7, 2026

CVE-2026-100721
38Monitor
vm2 before 3.12.2 Authorization Bypass via Custom Resolver
CriticalCVSS 9.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
patriksimek · vm23 days ago
CVE-2026-100723
27Monitor
vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Info leak
patriksimek · vm23 days ago
CVE-2026-100722
35Monitor
vm2 before 3.12.2 Host Process Termination via Construct Trap
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
patriksimek · vm23 days ago
CVE-2026-100664
34Monitor
Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
netty · netty3 days ago
CVE-2026-100663
34Monitor
Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
netty · netty3 days ago
CVE-2026-100653
33Monitor
vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
vllm-project · vllm3 days ago
CVE-2026-100652
32Monitor
vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
vllm-project · vllm3 days ago
CVE-2026-100651
28Monitor
vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
vllm-project · vllm3 days ago
CVE-2026-100640
34Monitor
SiYuan before v3.8.4 Clipboard Data Disclosure via IPC
HighCVSS 8.6No exploitEPSS 0%
- Info leak
siyuan-note · siyuan3 days ago
CVE-2026-100639
34Monitor
SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XSS
siyuan-note · siyuan3 days ago
CVE-2026-100635
32Monitor
SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
siyuan-note · siyuan3 days ago
CVE-2026-100665
34Monitor
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
netty · netty4 days ago
CVE-2026-100641
34Monitor
SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
HighCVSS 8.6No exploitEPSS 1%
- RCE
- XSS
siyuan-note · siyuan4 days ago
CVE-2026-100634
21Monitor
SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
siyuan-note · siyuan4 days ago
CVE-2026-100598
30Monitor
OpenClaw before 2026.7.1 Approval Binding Logic Error
HighCVSS 7.5No exploitEPSS 0%
openclaw · openclaw4 days ago
CVE-2026-100591
21Monitor
OpenClaw before 2026.7.1 Authentication Bypass via Active Memory
MediumCVSS 5.3No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
openclaw · openclaw4 days ago
CVE-2026-100590
21Monitor
OpenClaw before 2026.7.1 Authorization Bypass via voice set
MediumCVSS 5.3No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclaw4 days ago
CVE-2026-100592
21Monitor
OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming
MediumCVSS 5.3No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
openclaw · openclaw4 days ago
CVE-2026-100527
27Monitor
OpenClaw before 2026.8.2 Denial of Service via Browser Relay
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Denial of service
openclaw · openclaw4 days ago
CVE-2026-93604
27Monitor
vm2 3.11.8 Sandbox Escape via crypto.setFips
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
patriksimek · vm2Sep 18, 2026
CVE-2026-92958
33Monitor
vm2 before 3.11.7 Denylist Bypass via fs/promises
HighCVSS 8.4No exploitEPSS 0%
patriksimek · vm2Sep 17, 2026
CVE-2026-92954
36Monitor
vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
patriksimek · vm2Sep 17, 2026
CVE-2026-92953
37Monitor
vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Prototype pollution
patriksimek · vm2Sep 17, 2026
CVE-2026-92952
35Monitor
vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
patriksimek · vm2Sep 17, 2026
CVE-2026-86424
8Monitor
ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race
LowCVSS 2.0No exploitEPSS 0%
- Path traversal
- Race condition
imagemagick · imagemagickSep 7, 2026