Read the docs

CoreBunch

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

CoreBunch records in CISA KEV

No CoreBunch vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-84250 CVE-2026-121458 · GHSA-wq53-554h-vq3f

Instatic MCP read tools bypass authorization, exposing other users' data

Priority LOW 31

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows bel…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00309 Published 2026-11-03 Fixed in 0.0.21 CWE-862
TI-2026-50844 CVE-2026-72587 · GHSA-9p8f-ppfj-8gc5

Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

Priority LOW 27

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/ho…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00315 Published 2026-08-10 No fix listed CWE-444
Open these records in search →