Joshua MARTINELLELet’s talk
RESEARCH ARCHIVE — 001

CVEs & research.

Vulnerabilities I’ve found and disclosed, with links to vendor advisories and technical details.

Latest disclosure
CVE-2026-114437
Coordinated with
Tenable Research, vendors
Active since
2020

72

Disclosures

15

Critical findings

32

Products affected

7

Years of disclosures

DISCLOSURES / YEARSelect a year to filter
SEVERITY DISTRIBUTIONCVSS rating
  • Critical1521%
  • High2028%
  • Medium3650%
  • Low11%
Year
Severity

Showing 72 of 72

2026

29 disclosures
  1. 01CVE-2026-114437Broken AuthorizationGolang ChiMediumTenable
  2. 02TRA-2026-65Broken AuthenticationHermes AgentHighTenable
  3. 03TRA-2026-64Denial of ServiceHermes AgentMediumTenable
  4. 04TRA-2026-63Denial of ServiceHermes AgentMediumTenable
  5. 05CVE-2026-108125SQL InjectionWordPress Post AuthorMediumTenable
  6. 06CVE-2026-108124SQL InjectionWordPress Post AuthorMediumTenable
  7. 07CVE-2026-82123Reflected XSSWordPress Loops & LogicMediumTenable
  8. 08CVE-2026-18197Reflected XSSLink LibraryMediumTenable
  9. 09CVE-2026-20896Broken AuthenticationGiteaCriticalVendor
  10. 10CVE-2026-25119Broken AuthenticationGogsMediumTenable
  11. 11CVE-2026-9065SQL InjectionSurecartMediumTenable
  12. 12CVE-2026-9059SQL InjectionNextGEN GalleryMediumTenable
  13. 13CVE-2026-44706SQL InjectionChatwootHighTenable
  14. 14TRA-2026-32Path TraversalFlowiseMediumTenable
  15. 15CVE-2026-41274SQL InjectionFlowiseHighTenable
  16. 16CVE-2026-30824Broken AuthenticationFlowiseHighTenable
  17. 17TRA-2026-34Sensitive Information DisclosureFlowiseMediumTenable
  18. 18CVE-2026-5027Path TraversalLangflowHighTenable
  19. 19CVE-2026-5026Stored XSSLangflowHighTenable
  20. 20CVE-2026-5025Broken AuthenticationLangflowMediumTenable
  21. 21CVE-2026-5022Broken AuthenticationLangflowLowTenable
  22. 22CVE-2026-4984SSRFBotpressHighTenable
  23. 23TRA-2026-21Authorization BypassMiddayMediumTenable
  24. 24CVE-2026-27944Sensitive Information DisclosureNginx UICriticalTenable
  25. 25CVE-2026-3432Sensitive Information DisclosureSimStudioCriticalTenable
  26. 26CVE-2026-3431SSRFSimStudioCriticalTenable
  27. 27CVE-2026-27167Sensitive Information DisclosureGradioHighTenable
  28. 28CVE-2026-2577Broken AuthenticationNanobotCriticalTenable
  29. 29CVE-2026-25120Broken AuthenticationGogsMediumTenable

2025

5 disclosures
  1. 30TRA-2025-50Exposed API KeyWordPress PluginMediumTenable
  2. 31TRA-2025-34SSRF BypassBentoMLHighTenable
  3. 32TRA-2025-33Exposed API KeyWordPress PluginMediumTenable
  4. 33TRA-2025-32Exposed API KeyWordPress PluginMediumTenable
  5. 34CVE-2025-2304Privilege EscalationCamaleon CMSHighTenable

2024

10 disclosures
  1. 35CVE-2024-12015SQL InjectionWordPress PluginHighTenable
  2. 36CVE-2024-10859SQL InjectionWordPress PluginCriticalTenable
  3. 37CVE-2024-9148Stored XSSFlowiseAIMediumTenable
  4. 38CVE-2024-8182Denial of ServiceFlowiseAIHighTenable
  5. 39CVE-2024-7790Stored XSSStition AIMediumTenable
  6. 40CVE-2024-7297Privilege EscalationLangflow AIHighTenable
  7. 41CVE-2024-4960Reflected XSSWordPress PluginMediumNVD
  8. 42CVE-2024-4959Stored XSSSolidusMediumNVD
  9. 43CVE-2024-1063Blind SSRFAppWriteMediumTenable
  10. 44CVE-2024-1061SQL InjectionWordPress PluginCriticalTenable

2023

20 disclosures
  1. 45CVE-2023-6360SQL InjectionWordPress PluginCriticalTenable
  2. 46CVE-2023-4137Reflected XSSWordPress PluginMediumTenable
  3. 47CVE-2023-28667Insecure DeserializationWordPress PluginCriticalTenable
  4. 48CVE-2023-28666Reflected XSSWordPress PluginMediumTenable
  5. 49CVE-2023-28665Reflected XSSWordPress PluginMediumTenable
  6. 50CVE-2023-28664Reflected XSSWordPress PluginMediumTenable
  7. 51CVE-2023-28663SQL InjectionWordPress PluginHighTenable
  8. 52CVE-2023-28662SQL InjectionWordPress PluginCriticalTenable
  9. 53CVE-2023-28661SQL InjectionWordPress PluginHighTenable
  10. 54CVE-2023-28660SQL InjectionWordPress PluginHighTenable
  11. 55CVE-2023-28659SQL InjectionWordPress PluginHighTenable
  12. 56CVE-2023-28017Stored XSSCraftCMSMediumTenable
  13. 57CVE-2023-26326Insecure DeserializationWordPress PluginCriticalTenable
  14. 58CVE-2023-26325SQL InjectionWordPress PluginHighTenable
  15. 59CVE-2023-23492Reflected XSSWordPress PluginMediumTenable
  16. 60CVE-2023-23491Reflected XSSWordPress PluginMediumTenable
  17. 61CVE-2023-23490SQL InjectionWordPress PluginHighTenable
  18. 62CVE-2023-23489SQL InjectionWordPress PluginCriticalTenable
  19. 63CVE-2023-23488SQL InjectionWordPress PluginCriticalTenable
  20. 64CVE-2023-0448Reflected XSSWordPress PluginMediumTenable

2022

2 disclosures
  1. 65CVE-2022-1731SQL InjectionMetasonicCriticalTenable
  2. 66CVE-2022-38131Open RedirectRStudioMediumTenable

2021

3 disclosures
  1. 67CVE-2021-41262SQL InjectionGaletteHighNVD
  2. 68CVE-2021-41261Stored XSSGaletteMediumNVD
  3. 69CVE-2021-41260CSRFGaletteMediumNVD

2020

3 disclosures
  1. 70CVE-2020-25070CSRFUSVNMediumNVD
  2. 71CVE-2020-25069RCEUSVNCriticalNVD
  3. 72CVE-2020-15081Information DisclosurePrestaShopMediumNVD
DISCLOSURE POLICY

Every finding listed here went through coordinated disclosure. Advisories are linked once the vendor has shipped a fix or the disclosure deadline has passed.

Report a vulnerability to me