4
CVEs
0
Critical
0
High
0
KEV
4
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
0
LOW
4
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82664 | Reflected cross-site scripting in yaojingang GEOFlow through version 2.1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript via the Search argument in the JSON-LD Theme Handler (app/Http/Controllers/Site/HomeController.php). Exploitation requires passive user interaction - a victim must follow a crafted link - limiting the attack to phishing and session-hijacking scenarios. A public proof-of-concept has been disclosed via GitHub issue #60, and vendor-released patch v2.1.1 is available. | LOW | 2.1 | 0.3% | 31 |
PoC
|
| CVE-2026-82665 | Path traversal in yaojingang GEOFlow's Image Library Cleanup component allows remote authenticated administrators to delete arbitrary server files by supplying crafted directory-traversal sequences in the `file_path` argument to the PHP `unlink()` function within `ImageLibraryController.php`. All versions up to 2.1.0 are affected (CPE: cpe:2.3:a:yaojingang:geoflow:*:*:*:*:*:*:*:*), with a publicly available proof-of-concept on GitHub issue #60. No CISA KEV listing exists, and the admin-only requirement (PR:H per CVSS 4.0) constrains real-world impact, but the public POC makes patching urgent for any exposed instance. | LOW | 2.0 | 0.4% | 30 |
PoC
|
| CVE-2026-82666 | Code injection in yaojingang GEOFlow versions up to 2.1.0 allows a remote superadmin to execute arbitrary PHP on the server by submitting a malicious Blade template payload to the preview function of the Superadmin Theme Editor (SiteThemeEditorController.php). A publicly available proof-of-concept exploit has been disclosed via GitHub issue #60, and the attack requires no user interaction beyond the attacker's own authenticated session. Vendor-released patch version 2.1.1 resolves the issue; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis. | LOW | 2.0 | 0.4% | 30 |
PoC
|
| CVE-2026-82667 | Server-side request forgery in yaojingang GEOFlow up to 2.1.0 allows high-privileged authenticated attackers to make the application server issue arbitrary outbound HTTP requests by supplying a crafted value to the endpoint_url argument of DistributionController.isValidHttpEndpoint in GenericHttpEndpointResolver.php. The vulnerability carries a very low CVSS 4.0 score of 2.0 due to the PR:H requirement, limiting realistic attacker population to those already holding elevated application credentials. A public exploit has been disclosed via GitHub issue #60, though no active exploitation has been confirmed by CISA KEV. | LOW | 2.0 | 0.3% | 30 |
PoC
|