Skip to content
Ssaltcorn
Products
| Product | CVEs | Exploited | Latest |
|---|
| saltcorn | 4 | – | May 7, 2026 |
Exploited and recent CVEs
-
CVE-2026-42259
Medium 5.1
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
0.3%
-
CVE-2026-41478
Critical 10.0
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
0.3%
-
CVE-2026-40163
High 8.2
Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read
0.3%
-
CVE-2024-47818
Medium 6.5
Logged-in users with any role can delete arbitrary files in @saltcorn/server
0.8%