Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: CoreBunch Clear all filters
TI-2026-84250 CVE-2026-121458 · GHSA-wq53-554h-vq3f

Instatic MCP read tools bypass authorization, exposing other users' data

Priority LOW 31

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows bel…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00309 Published 2026-11-03 Fixed in 0.0.21 CWE-862
TI-2026-50844 CVE-2026-72587 · GHSA-9p8f-ppfj-8gc5

Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

Priority LOW 27

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/ho…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00315 Published 2026-08-10 No fix listed CWE-444