CodeWithCJ

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

CodeWithCJ records in CISA KEV

No CodeWithCJ vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Sparkyfitness 1 record MEDIUM

Records

4 records

TI-2026-75359 CVE-2026-92263

OS command injection in SparkyFitness backup restore

HIGH 67

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0045 Published 2026-10-16 Fixed in 1.6.0 CWE-78

TI-2025-40340 CVE-2025-65368 · GHSA-m77m-g5m4-wr4f

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.

MEDIUM 60

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00251 Published 2026-01-15 No fix listed CWE-79

TI-2026-75335 CVE-2026-102923

Server-side request forgery in SparkyFitness AI service settings

MEDIUM 58

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00265 Published 2026-10-16 Fixed in 1.6.0 CWE-918

TI-2026-76941 CVE-2026-113612 · GHSA-p92j-4g3m-hx3x

SparkyFitness missing authorization lets users delete others' food variants

MEDIUM 57

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-20 Fixed in 0.17.0 CWE-862

Open these records in search →

Critical	0
High	1
Medium	3
Low	0
No CVSS	0