3
CVEs
0
Critical
0
High
0
KEV
3
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
2
LOW
1
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85637 | Missing authentication on the admin WebSocket endpoint in trape 1.0.0 and 2.0 exposes operator tracking sessions to unauthenticated remote attackers. The `join_room` function in `core/sockets.py` performs no credential check before admitting a caller to the admin room, meaning any network-reachable party can connect to the socket and observe victim tracking data intended solely for the trape operator. A public exploit exists via a GitHub issue report; the project maintainer has not responded to the disclosure. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-85638 | Authorization bypass via insecure direct object reference (IDOR) in jofpin trape 2.0 allows remote unauthenticated attackers to access or manipulate tracked-subject records by substituting arbitrary values for the vId/id parameters handled in core/user.py. The affected product is an open-source Python OSINT people-tracking framework; exploitation requires only network reachability to the trape instance with no credentials or user interaction. A public proof-of-concept exists via GitHub issue #407, and the vendor has not responded to the disclosure. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-85639 | Race condition in jofpin trape 2.0 allows remote unauthenticated attackers to manipulate telemetry data via the vId argument in core/user.py's Telemetry Endpoint, yielding low-impact confidentiality, integrity, and availability compromise. Exploitation is rated high complexity (AC:H) due to the timing requirements inherent in race condition attacks, and the CVSS 4.0 base score is 2.9. A public proof-of-concept exists as a GitHub issue report (#408); the project maintainer has not responded to the disclosure. | LOW | 2.9 | 0.2% | 35 |
PoC
No patch
|