CervantesSec has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 6.1 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-115975High· 7.1Broken access control in JiraController39CVE-2026-115993Medium· 6.8Stored XSS in the “Notes” field of project checklists37CVE-2026-115994Medium· 5.4BOLA Allows Cross-Project Target Tampering30CVE-2026-115998Medium· 4.3IDOR: User reads and modifies findings from other people's projects24
CervantesSec vulnerabilities
CVEs affecting CervantesSec, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-115998Medium· 4.3IDOR: User reads and modifies findings from other people's projects
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify find…
CVE-2026-115994Medium· 5.4BOLA Allows Cross-Project Target Tampering
BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, resu…
CVE-2026-115993Medium· 6.8Stored XSS in the “Notes” field of project checklists
Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges
CVE-2026-115975High· 7.1Broken access control in JiraController
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects