Damselfly vulnerabilities

CVEs whose affected-version data names the Damselfly package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111626Critical· 9.8

today

Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /ap…

▾ MidnightWebreaper · Damselflyvia CVEORG