pinchtab

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

pinchtab records in CISA KEV

No pinchtab vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pinchtab 7 records HIGH

Records

7 records in Pinchtab · all components

TI-2026-23663 CVE-2026-30834 · GHSA-rw8p-c6hf-q3pg

PinchTab: SSRF with Full Response Exfiltration via Download Handler

HIGH 72

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00467 Published 2026-03-07 Fixed in 0.7.7 CWE-918

TI-2026-26005 CVE-2026-33623 · GHSA-p8mm-644p-phmh

PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution

HIGH 67

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03016 Published 2026-03-26 Fixed in 0.8.5 CWE-400

TI-2026-26003 CVE-2026-33621 · GHSA-j65m-hv65-r264

PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token

MEDIUM 62

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0032 Published 2026-03-26 Fixed in 0.8.5 CWE-290

TI-2026-26004 CVE-2026-33622 · GHSA-w5pc-m664-r62v

A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution

MEDIUM 60

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser.

CVSS 4.0MEDIUM 6.1 Network High privileges No interaction EPSS 0.00532 Published 2026-03-26 No fix listed CWE-284

TI-2026-26001 CVE-2026-33619 · GHSA-xqq2-4j46-vwp7

PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl

MEDIUM 58

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00258 Published 2026-03-26 Fixed in 0.8.4 CWE-918

TI-2026-26002 CVE-2026-33620 · GHSA-mrqc-3276-74f8

PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems

MEDIUM 53

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00284 Published 2026-03-26 Fixed in 0.8.4 CWE-598

TI-2026-25523 CVE-2026-33081 · GHSA-qwxp-6qf9-wr4m

PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation

LOW 32

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.003 Published 2026-03-20 Fixed in 0.8.3 CWE-918

Open these records in search →