Skip to content
Noroxi

kidocode records

18 published records for vendor kidocode.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
5
With a fix record
94.4%
Median publish → KEV
No record has entered KEV

Records by year

  1. 25
  2. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

18 records
  • CVE-2026-26216
    42Plan

    Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter

    CriticalCVSS 10.0Proof of conceptEPSS 6%

    kidocode · crawl4aiFeb 12, 2026

  • CVE-2026-53753
    41Plan

    Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

    CriticalCVSS 10.0Proof of conceptEPSS 3%

    kidocode · crawl4aiJun 23, 2026

  • CVE-2026-57572
    40Plan

    Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

    CriticalCVSS 10.0No exploitEPSS 1%

    kidocode · crawl4aiJul 6, 2026

  • CVE-2026-56265
    38Monitor

    Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

    CriticalCVSS 9.3Proof of conceptEPSS 3%

    kidocode · crawl4aiJun 21, 2026

  • CVE-2026-57571
    38Monitor

    Crawl4AI arbitrary file write via download filename path traversal

    CriticalCVSS 9.6No exploitEPSS 1%

    kidocode · crawl4aiJul 6, 2026

  • CVE-2026-26217
    37Monitor

    Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling

    CriticalCVSS 9.2Proof of conceptEPSS 2%

    kidocode · crawl4aiFeb 12, 2026

  • CVE-2026-56258
    36Monitor

    Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU

    CriticalCVSS 9.2No exploitEPSS 1%

    kidocode · crawl4aiJun 23, 2026

  • CVE-2026-56261
    36Monitor

    Crawl4AI - Server-Side Request Forgery via Webhook URLs

    CriticalCVSS 9.2No exploitEPSS 1%

    kidocode · crawl4aiJul 10, 2026

  • CVE-2026-56264
    36Monitor

    Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint

    CriticalCVSS 9.2No exploitEPSS 0%

    kidocode · crawl4aiJun 30, 2026

  • CVE-2026-56266
    36Monitor

    Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints

    CriticalCVSS 9.2No exploitEPSS 0%

    kidocode · crawl4aiJun 22, 2026

  • CVE-2025-28197
    36Monitor

    Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.

    CriticalCVSS 9.1No exploitEPSS 0%

    kidocode · crawl4aiApr 18, 2025

  • CVE-2026-56260
    35Monitor

    Crawl4AI - Arbitrary File Write via output_path Parameter

    HighCVSS 8.8No exploitEPSS 1%

    kidocode · crawl4aiJul 12, 2026

  • CVE-2026-56259
    35Monitor

    Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution

    HighCVSS 8.8No exploitEPSS 0%

    kidocode · crawl4aiJul 12, 2026

  • CVE-2026-57573
    34Monitor

    Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint

    HighCVSS 8.6No exploitEPSS 0%

    kidocode · crawl4aiJul 6, 2026

  • CVE-2026-53755
    30Monitor

    Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check

    HighCVSS 7.5Proof of conceptEPSS 2%

    kidocode · crawl4aiJun 23, 2026

  • CVE-2026-53754
    30Monitor

    Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)

    HighCVSS 7.5No exploitEPSS 0%

    kidocode · crawl4aiJun 23, 2026

  • CVE-2026-56262
    27Monitor

    Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server

    MediumCVSS 6.9No exploitEPSS 1%

    kidocode · crawl4aiJun 24, 2026

  • CVE-2026-56263
    21Monitor

    Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard

    MediumCVSS 5.3No exploitEPSS 0%

    kidocode · crawl4aiJun 23, 2026