Read the docs

CervantesSec

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

CervantesSec records in CISA KEV

No CervantesSec vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cervantes 2 records LOW

Records

6 records

TI-2026-80063 CVE-2026-115975 · GHSA-mvvf-m63r-wxwg

Broken access control in Cervantes JiraController

Priority LOW 31

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00215 Published 2026-10-24 Fixed in v.1.4.0-beta CWE-862
TI-2026-80064 CVE-2026-115993 · GHSA-fgjg-4v79-vhpp

Stored XSS in the Notes field of Cervantes project checklists

Priority LOW 30

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00321 Published 2026-10-24 Fixed in v.1.4.0-beta CWE-79
TI-2026-80075 CVE-2026-115994 · GHSA-m7gg-rxfc-j545

Cervantes BOLA lets users change other projects' targets

Priority LOW 24

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration test…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-24 Fixed in v.1.4.0-beta CWE-639
TI-2026-80076 CVE-2026-115998 · GHSA-5c44-fgrh-f6cp

Cervantes lets users read and change findings in other projects

Priority LOW 19

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00198 Published 2026-10-24 Fixed in v.1.4.0-beta CWE-639
Open these records in search →