{"id":"CVE-2026-37107","title":"An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component","summary":"An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component","severity":"none","published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T18:17:23.847","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-37107","references":[{"url":"https://gist.github.com/KyrieKlay/b61a7563d7887d2a01060fcb0bf825eb","label":"cve@mitre.org"},{"url":"https://github.com/danpros/htmly/releases/tag/v3.1.1","label":"cve@mitre.org"},{"url":"https://www.htmly.com/","label":"cve@mitre.org"}],"tags":["nvd","exploit-available"],"exploits":{"github":1,"githubRepos":["https://github.com/KyrieKlay/CVE-2026-37107"],"checkedAt":"2026-10-13T18:42:17.260Z"},"exploitAvailable":true,"ingestedAt":"2026-10-13T18:41:42.743Z","slug":"CVE-2026-37107","body":"## Overview\n\nAn issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}