2
CVEs
0
Critical
1
High
0
KEV
1
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-56677 | Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe internal network services by supplying an arbitrary issuerUrl to the /api/auth/oidc/test endpoint, which the application fetches without validating against private or loopback address ranges. The reflected OIDC discovery fields - including token_endpoint and jwks_uri - expose internal service metadata, enabling internal network enumeration. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack surface makes opportunistic scanning plausible. | HIGH | 8.6 | 0.3% | 63 |
PoC
No patch
|
| CVE-2026-72860 | Server-side request forgery in decolua 9router ≤ 0.5.55 allows session-authenticated users (or unauthenticated callers when requireLogin is disabled) to reach internal network resources via the POST /api/provider-nodes/validate endpoint. The SSRF guard's IPv4-mapped IPv6 branch is structurally unreachable: WHATWG URL canonicalization rewrites dotted-quad notation to hextet form before the string regex is evaluated, so addresses such as http://[::ffff:7f00:1] (loopback) and http://[::ffff:a9fe:a9fe] (cloud metadata) pass unchecked. No public exploit has been identified at time of analysis, though the root cause and bypass technique are fully documented in the public GitHub issue and fix PR. | MEDIUM | 6.3 | 0.2% | 32 |
No patch
|