Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: NangoHQ Clear all filters
TI-2026-62543 CVE-2026-92804 · GHSA-29mm-6vmq-g8cg

Nango through 0.70.4 Server-Side Request Forgery via Configuration

Priority MEDIUM 64

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00369 Published 2026-09-16 No fix listed CWE-918
TI-2026-08178 CVE-2026-9317 · GHSA-9cph-w8mv-q56r

Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Priority MEDIUM 44

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without cre…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01264 Published 2026-09-04 Fixed in 0.71.6 CWE-306