piccolo-orm

Products

Product	CVEs	Exploited	Latest
piccolo	2	–	Nov 10, 2023
piccolo_admin	2	–	Aug 28, 2026

CVE-2026-55485 High 8.8 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/. 0.6%
CVE-2024-30248 High 7.7 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page 0.5%
CVE-2023-47128 Critical 9.1 piccolo SQL Injection via named transaction savepoints 0.8%
CVE-2023-41885 Medium 5.3 Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration 0.6%