Aaehrc

Products

Exploited and recent CVEs

• CVE-2026-47664 High 8.6 Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning 0.2%
• CVE-2026-47663 High 8.7 Pathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutation 0.4%
• CVE-2026-47662 High 8.7 Pathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLs 0.4%
• CVE-2026-47661 High 8.7 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read 0.6%
• CVE-2026-47660 High 8.7 Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration 0.5%
• CVE-2026-47659 High 8.7 Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename} 0.6%