Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: tianma-if Clear all filters
TI-2026-71289 CVE-2026-109559 · GHSA-p9qx-79pg-cv5g

Navigation allowlist bypass in EdgeEver Desktop exposes its bridge

Priority LOW 36

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00309 Published 2026-10-12 No fix listed CWE-863
TI-2026-71288 CVE-2026-109558 · GHSA-f2xf-xr5r-qf3x

EdgeEver Stored XSS via TemplatesPane Template Preview

Priority HIGH 72

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00419 Published 2026-10-12 No fix listed CWE-79
TI-2026-71287 CVE-2026-109557 · GHSA-489r-rjvf-hwg5

Stored cross-site scripting in EdgeEver drag preview

Priority HIGH 72

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00419 Published 2026-10-12 No fix listed CWE-79
TI-2026-71286 CVE-2026-109556 · GHSA-x8jx-mq2j-m3pv

Code execution in EdgeEver Desktop via unchecked ACP IPC handler

Priority HIGH 67

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00654 Published 2026-10-12 No fix listed CWE-749
TI-2026-70706 CVE-2026-108727 · GHSA-v569-q6j4-2968

Missing authorization in EdgeEver memo template API routes

Priority MEDIUM 57

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never cal…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00325 Published 2026-10-11 No fix listed CWE-862