daptin

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

daptin records in CISA KEV

No daptin vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-83293 CVE-2026-62160

Uncontrolled CPU use in Daptin via Accept-Language header parsing

HIGH 77

Daptin is a GraphQL/JSON-API headless CMS.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00417 Published 2026-10-30 Fixed in 0.12.26 CWE-400

TI-2026-32315 CVE-2026-44349 · GHSA-pwqg-q8pg-pp6r

Daptin fuzzy search injects unvalidated column name into raw SQL

HIGH 70

Daptin is a GraphQL/JSON-API headless CMS.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00305 Published 2026-05-07 Fixed in 0.11.5 CWE-89

TI-2026-50833 CVE-2026-72575 · GHSA-w34h-746p-3wp3

daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects

MEDIUM 48

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00529 Published 2026-08-10 No fix listed CWE-284

TI-2026-30021 CVE-2026-41422 · GHSA-rw2c-8rfq-gwfv

Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API

LOW 38

Daptin is a GraphQL/JSON-API headless CMS.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00345 Published 2026-05-07 Fixed in 0.11.4 CWE-89

Open these records in search →

Critical	1
High	3
Medium	0
Low	0
No CVSS	0