CodeWithCJ SparkyFitness

• CVE-2026-113612 Medium 5.4 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint 0.4%
• CVE-2026-102923 Medium 5.4 SparkyFitness: SSRF via unvalidated custom_url in AI service settings 0.3%
• CVE-2026-92263 High 7.2 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore 0.4%