TI-2026-33317 CVE-2026-45568 · GHSA-jh67-hwqw-m5r7
zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
Priority MEDIUM 50
zrok is software for sharing web services, files, and network resources.
Netfoundry
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Netfoundry records in CISA KEVNo Netfoundry vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Zrok · all components
TI-2026-30586 CVE-2026-42275 · GHSA-74m3-9qvm-rp9h
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
Priority MEDIUM 40
zrok is software for sharing web services, files, and network resources.
TI-2026-29081 CVE-2026-40303 · GHSA-cpf9-ph2j-ccr9
zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing
Priority LOW 39
zrok is software for sharing web services, files, and network resources.
TI-2026-33325 CVE-2026-45576 · GHSA-c656-jcx2-7pqj
zrok copy writes attacker-controlled WebDAV paths outside the destination root
Priority LOW 37
zrok is software for sharing web services, files, and network resources.
TI-2026-29080 CVE-2026-40302 · GHSA-4fxq-2x3x-6xqx
zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering
Priority LOW 27
zrok is software for sharing web services, files, and network resources.
TI-2026-29082 CVE-2026-40304 · GHSA-3jpj-v3xr-5h6g
zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
Priority LOW 24
zrok is software for sharing web services, files, and network resources.