14 matches found
CVE-2026-121458
Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...
CVE-2026-121458
Versions of Instatic prior to 0.0.21 are vulnerable to a missing authorization flaw in the AI/MCP content read tools . The root cause is a lack of object-level authorization checks in the content_get_document and content_list_documents functions, which are otherwise enforced by the standard HTTP ...
EUVD-2026-115812
Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...
CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools
Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...
Instatic-Stored-XSS-CVE-2026-103931
URL scheme filter bypass in isSafeUrl via leading C0 control characters Affected: Instatic v0.0.13 / commit 63ad5d6 and all earlier revisions containing src/core/html-sanitize/index.ts Component: src/core/html-sanitize/index.ts → isSafeUrl / safeUrl Class: CWE-79 Stored XSS via CWE-184 Incomplete...
Exploit for CVE-2026-103931
Instatic-Sto...
CVE-2026-72587
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...
CVE-2026-72587 Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...
CVE-2026-72587
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...
CVE-2026-72587
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...
CVE-2026-72587 Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...
CVE-2026-72587
CVE-2026-72587 affects CoreBunch/Instatic up to version 0.0.14. The vulnerability exists in the server island endpoint GET /_instatic/hole/, where unauthenticated remote attackers can poison the shared render cache by modifying the u query parameter. The originating-page URL supplied in u seeds t...
PT-2026-69471
Name of the Vulnerable Software and Affected Versions CoreBunch/Instatic versions 0.0.1 through 0.0.14 Description An unauthenticated remote attacker can poison the shared process-wide render cache. By manipulating the u query parameter of the GET '/ instatic/hole/' server island endpoint, an...
CVE-2026-72587: Inconsistent Interpretation of HTTP Requests
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...