SpiceJet

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

SpiceJet records in CISA KEV

No SpiceJet vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-05595 CVE-2026-6376 · GHSA-2pp5-c2qh-f9wq

Missing authentication for critical function in SpiceJet Online Booking System

MEDIUM 44

A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00497 Published 2026-04-23 No fix listed CWE-306

TI-2026-05594 CVE-2026-6375 · GHSA-x532-492q-g257

Authorization bypass through User-Controlled key in SpiceJet Online Booking System

MEDIUM 43

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00311 Published 2026-04-23 No fix listed CWE-639

Open these records in search →

Critical	0
High	2
Medium	0
Low	0
No CVSS	0