Joshua MARTINELLELet’s talk
RESEARCH ARCHIVE — 001

CVEs & research.

Vulnerabilities I’ve found and disclosed, with links to vendor advisories and technical details.

Latest disclosure
CVE-2026-82123
Coordinated with
Tenable Research, vendors
Active since
2020

66

Disclosures

15

Critical findings

29

Products affected

7

Years of disclosures

DISCLOSURES / YEARSelect a year to filter
SEVERITY DISTRIBUTIONCVSS rating
  • Critical1523%
  • High1929%
  • Medium3147%
  • Low12%
Year
Severity

Showing 66 of 66

2026

23 disclosures
  1. 01CVE-2026-82123Reflected XSSWordPress Loops & LogicMediumTenable
  2. 02CVE-2026-18197Reflected XSSLink LibraryMediumTenable
  3. 03CVE-2026-20896Broken AuthenticationGiteaCriticalVendor
  4. 04CVE-2026-25119Broken AuthenticationGogsMediumTenable
  5. 05CVE-2026-9065SQL InjectionSurecartMediumTenable
  6. 06CVE-2026-9059SQL InjectionNextGEN GalleryMediumTenable
  7. 07CVE-2026-44706SQL InjectionChatwootHighTenable
  8. 08TRA-2026-32Path TraversalFlowiseMediumTenable
  9. 09CVE-2026-41274SQL InjectionFlowiseHighTenable
  10. 10CVE-2026-30824Broken AuthenticationFlowiseHighTenable
  11. 11TRA-2026-34Sensitive Information DisclosureFlowiseMediumTenable
  12. 12CVE-2026-5027Path TraversalLangflowHighTenable
  13. 13CVE-2026-5026Stored XSSLangflowHighTenable
  14. 14CVE-2026-5025Broken AuthenticationLangflowMediumTenable
  15. 15CVE-2026-5022Broken AuthenticationLangflowLowTenable
  16. 16CVE-2026-4984SSRFBotpressHighTenable
  17. 17TRA-2026-21Authorization BypassMiddayMediumTenable
  18. 18CVE-2026-27944Sensitive Information DisclosureNginx UICriticalTenable
  19. 19CVE-2026-3432Sensitive Information DisclosureSimStudioCriticalTenable
  20. 20CVE-2026-3431SSRFSimStudioCriticalTenable
  21. 21CVE-2026-27167Sensitive Information DisclosureGradioHighTenable
  22. 22CVE-2026-2577Broken AuthenticationNanobotCriticalTenable
  23. 23CVE-2026-25120Broken AuthenticationGogsMediumTenable

2025

5 disclosures
  1. 24TRA-2025-50Exposed API KeyWordPress PluginMediumTenable
  2. 25TRA-2025-34SSRF BypassBentoMLHighTenable
  3. 26TRA-2025-33Exposed API KeyWordPress PluginMediumTenable
  4. 27TRA-2025-32Exposed API KeyWordPress PluginMediumTenable
  5. 28CVE-2025-2304Privilege EscalationCamaleon CMSHighTenable

2024

10 disclosures
  1. 29CVE-2024-12015SQL InjectionWordPress PluginHighTenable
  2. 30CVE-2024-10859SQL InjectionWordPress PluginCriticalTenable
  3. 31CVE-2024-9148Stored XSSFlowiseAIMediumTenable
  4. 32CVE-2024-8182Denial of ServiceFlowiseAIHighTenable
  5. 33CVE-2024-7790Stored XSSStition AIMediumTenable
  6. 34CVE-2024-7297Privilege EscalationLangflow AIHighTenable
  7. 35CVE-2024-4960Reflected XSSWordPress PluginMediumNVD
  8. 36CVE-2024-4959Stored XSSSolidusMediumNVD
  9. 37CVE-2024-1063Blind SSRFAppWriteMediumTenable
  10. 38CVE-2024-1061SQL InjectionWordPress PluginCriticalTenable

2023

20 disclosures
  1. 39CVE-2023-6360SQL InjectionWordPress PluginCriticalTenable
  2. 40CVE-2023-4137Reflected XSSWordPress PluginMediumTenable
  3. 41CVE-2023-28667Insecure DeserializationWordPress PluginCriticalTenable
  4. 42CVE-2023-28666Reflected XSSWordPress PluginMediumTenable
  5. 43CVE-2023-28665Reflected XSSWordPress PluginMediumTenable
  6. 44CVE-2023-28664Reflected XSSWordPress PluginMediumTenable
  7. 45CVE-2023-28663SQL InjectionWordPress PluginHighTenable
  8. 46CVE-2023-28662SQL InjectionWordPress PluginCriticalTenable
  9. 47CVE-2023-28661SQL InjectionWordPress PluginHighTenable
  10. 48CVE-2023-28660SQL InjectionWordPress PluginHighTenable
  11. 49CVE-2023-28659SQL InjectionWordPress PluginHighTenable
  12. 50CVE-2023-28017Stored XSSCraftCMSMediumTenable
  13. 51CVE-2023-26326Insecure DeserializationWordPress PluginCriticalTenable
  14. 52CVE-2023-26325SQL InjectionWordPress PluginHighTenable
  15. 53CVE-2023-23492Reflected XSSWordPress PluginMediumTenable
  16. 54CVE-2023-23491Reflected XSSWordPress PluginMediumTenable
  17. 55CVE-2023-23490SQL InjectionWordPress PluginHighTenable
  18. 56CVE-2023-23489SQL InjectionWordPress PluginCriticalTenable
  19. 57CVE-2023-23488SQL InjectionWordPress PluginCriticalTenable
  20. 58CVE-2023-0448Reflected XSSWordPress PluginMediumTenable

2022

2 disclosures
  1. 59CVE-2022-1731SQL InjectionMetasonicCriticalTenable
  2. 60CVE-2022-38131Open RedirectRStudioMediumTenable

2021

3 disclosures
  1. 61CVE-2021-41262SQL InjectionGaletteHighNVD
  2. 62CVE-2021-41261Stored XSSGaletteMediumNVD
  3. 63CVE-2021-41260CSRFGaletteMediumNVD

2020

3 disclosures
  1. 64CVE-2020-25070CSRFUSVNMediumNVD
  2. 65CVE-2020-25069RCEUSVNCriticalNVD
  3. 66CVE-2020-15081Information DisclosurePrestaShopMediumNVD
DISCLOSURE POLICY

Every finding listed here went through coordinated disclosure. Advisories are linked once the vendor has shipped a fix or the disclosure deadline has passed.

Report a vulnerability to me