GGCHQ

Products

Exploited and recent CVEs

• CVE-2026-72912 Medium 4.3 CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL 0.3%
• CVE-2026-57439 Medium 5.0 CyberChef: Prototype pollution in Series Chart operation 0.1%
• CVE-2026-42615 High 7.2 GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring. 0.3%
• CVE-2025-25182 Critical 9.4 Stroom Authentication/Authorization Bypass when using AWS ALB 0.7%