pinchtab records
7 published records for vendor pinchtab.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 85.7%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-918 Server-Side Request Forgery (SSRF)3
- CWE-290 Authentication Bypass by Spoofing1
- CWE-598 Use of HTTP Request With Sensitive Query String1
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
7 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
30Monitor | CVE-2026-30834No exploit | PinchTab: SSRF with Full Response Exfiltration via Download Handlerpinchtab · pinchtab · CWE-918 | High7.5 | — | 0.4% | Mar 7, 2026 |
29Monitor | CVE-2026-33623No exploit | PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Executionpinchtab · pinchtab · CWE-78 | High7.2 | — | 3.4% | Mar 26, 2026 |
26Monitor | CVE-2026-33621No exploit | PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Tokenpinchtab · pinchtab · CWE-290 | Medium6.5 | — | 0.4% | Mar 26, 2026 |
24Monitor | CVE-2026-33622No exploit | A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Executionpinchtab · pinchtab · CWE-94 | Medium6.1 | — | 0.7% | Mar 26, 2026 |
22Monitor | CVE-2026-33619No exploit | PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrlpinchtab · pinchtab · CWE-918 | Medium5.5 | — | 0.3% | Mar 26, 2026 |
17Monitor | CVE-2026-33620No exploit | PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systemspinchtab · pinchtab · CWE-598 | Medium4.3 | — | 0.3% | Mar 26, 2026 |
14Monitor | CVE-2026-33081No exploit | PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validationpinchtab · pinchtab · CWE-918 | Low3.7 | — | 0.3% | Mar 20, 2026 |
- CVE-2026-3083430Monitor
PinchTab: SSRF with Full Response Exfiltration via Download Handler
HighCVSS 7.5No exploitEPSS 0%pinchtab · pinchtabMar 7, 2026
- CVE-2026-3362329Monitor
PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution
HighCVSS 7.2No exploitEPSS 3%pinchtab · pinchtabMar 26, 2026
- CVE-2026-3362126Monitor
PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token
MediumCVSS 6.5No exploitEPSS 0%pinchtab · pinchtabMar 26, 2026
- CVE-2026-3362224Monitor
A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution
MediumCVSS 6.1No exploitEPSS 0%pinchtab · pinchtabMar 26, 2026
- CVE-2026-3361922Monitor
PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl
MediumCVSS 5.5No exploitEPSS 0%pinchtab · pinchtabMar 26, 2026
- CVE-2026-3362017Monitor
PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems
MediumCVSS 4.3No exploitEPSS 0%pinchtab · pinchtabMar 26, 2026
- CVE-2026-3308114Monitor
PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation
LowCVSS 3.7No exploitEPSS 0%pinchtab · pinchtabMar 20, 2026