Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: CervantesSec Clear all filters
TI-2026-80076 CVE-2026-115998 · GHSA-5c44-fgrh-f6cp

Cervantes lets users read and change findings in other projects

Priority LOW 19

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00198 Published 2026-10-24 Fixed in v.1.4.0-beta CWE-639
TI-2026-80075 CVE-2026-115994 · GHSA-m7gg-rxfc-j545

Cervantes BOLA lets users change other projects' targets

Priority LOW 24

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration test…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-24 Fixed in v.1.4.0-beta CWE-639
TI-2026-80064 CVE-2026-115993 · GHSA-fgjg-4v79-vhpp

Stored XSS in the Notes field of Cervantes project checklists

Priority LOW 30

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00321 Published 2026-10-24 Fixed in v.1.4.0-beta CWE-79
TI-2026-80063 CVE-2026-115975 · GHSA-mvvf-m63r-wxwg

Broken access control in Cervantes JiraController

Priority LOW 31

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00215 Published 2026-10-24 Fixed in v.1.4.0-beta CWE-862