Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-90945

Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Crawlab-team
Products
Crawlab
CVE-2026-75103

Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Crawlab-team
Products
Crawlab