CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 07/05/2026 |
| CVE-2026-41422 | HIGH8.3 | Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with | 07/05/2026 |
| GHSA-258c-965c-p3hc | MEDIUM6.5 | Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change | 07/05/2026 |
| GHSA-9cp7-j3f8-p5jx | CRITICAL10.0 | Daptin has Unauthenticated Path Traversal and Zip Slip | 10/04/2026 |