Eden

Case studies

Explore Eden’s CVE remediation tests, what the controls blocked, and where coverage ends.

Urgency ranks known exploited CVEs first, then CVSS severity and score.

CVE remediation case studies
Cisco Secure Email Gateway: SQL injection during email parsingCVE-2026-76461Discovered Published CVE-2026-76461critical9.8Known exploited5 min
Drupal core: SQL injection on PostgreSQL sitesCVE-2026-9082Discovered Published CVE-2026-9082critical9.8Known exploited5 min
FortiClientEMS 7.4.4: SQL injectionCVE-2026-21643Discovered Published CVE-2026-21643critical9.1Known exploited5 min
IBM Langflow OSS: auto-login and code-validation chainCVE-2026-9198Discovered Published CVE-2026-9198critical9.8Known exploited5 min
Langflow: unauthenticated code execution in the validation APICVE-2025-3248Discovered Published CVE-2025-3248critical9.8Known exploited6 min
Metabase: SQL injection through password resetCVE-2026-72898Discovered Published CVE-2026-72898critical10.0Known exploited7 min
WordPress: path traversal in page-template resolutionCVE-2026-87902Discovered Published CVE-2026-87902high8.1Known exploited5 min
AppFlowy Cloud: stored XSS via blob upload Content-TypeCVE-2026-127203Discovered Published CVE-2026-127203medium5.16 min
Kendo UI for jQuery: XSS in Form item hintsCVE-2026-124695Discovered Published CVE-2026-124695high7.17 min
Kendo UI for jQuery: XSS in Spreadsheet sheet namesCVE-2026-124696Discovered Published CVE-2026-124696high7.17 min
Kendo UI for jQuery: XSS in the Chart default tooltipCVE-2026-124698Discovered Published CVE-2026-124698high7.16 min
Kendo UI for jQuery: XSS in the Chart shared tooltipCVE-2026-124697Discovered Published CVE-2026-124697high7.17 min
Kendo UI for jQuery: XSS in the Gantt Parent dropdownCVE-2026-124691Discovered Published CVE-2026-124691high7.17 min
MLflow: path traversal via model_id in the log outputs APICVE-2026-127202Discovered Published CVE-2026-127202medium6.36 min
Plesk Obsidian: cross-subscription disclosure in GoAccess statisticsCVE-2026-82977Discovered Published CVE-2026-82977high8.46 min
Alinto SOGo: DoS via auxiliary IMAP greeting waitCVE-2026-127141Discovered Published CVE-2026-127141high7.14 min
Alinto SOGo: missing rate limiting on TOTP verificationCVE-2026-127131Discovered Published CVE-2026-127131critical9.14 min
Alinto SOGo: S/MIME certificate spoofing via UIxMailViewCVE-2026-127121Discovered Published CVE-2026-127121high7.14 min
Alinto SOGo: Sieve script injection via notificationsCVE-2026-127135Discovered Published CVE-2026-127135medium5.34 min
Alinto SOGo: SSRF via web calendar subscriptionsCVE-2026-127145Discovered Published CVE-2026-127145medium5.34 min
Alinto SOGo: unauthenticated password recovery brute forceCVE-2026-127111Discovered Published CVE-2026-127111critical9.14 min
ComfyUI-Easy-Use: unauthenticated path traversalCVE-2026-123790Discovered Published CVE-2026-123790Unrated4 min
JeecgBoot: request-filter fixture for the OpenAPI SSRF advisoryCVE-2026-126998Discovered Published CVE-2026-126998medium6.94 min
JeecgBoot: SSRF via flow-run endpointCVE-2026-126997Discovered Published CVE-2026-126997medium6.94 min
ToolJet: authorization bypass via app-environments initCVE-2026-70642Discovered Published CVE-2026-70642medium5.34 min
AdonisJS: open redirect via unencoded route parametersCVE-2026-107718Discovered Published CVE-2026-107718medium6.16 min
AdonisJS: ReDoS via uncontrolled regex complexityCVE-2026-104150Discovered Published CVE-2026-104150high8.76 min
AdonisJS: reflected XSS through the exception handlerCVE-2026-61526Discovered Published CVE-2026-61526medium6.16 min
Apache CGI: limited RCE via internal redirects to non-CGI filesCVE-2026-42356Discovered Published CVE-2026-42356low3.76 min
Apache HTTP Server: OOB write in ap_directory_walkCVE-2026-59685Discovered Published CVE-2026-59685high7.56 min
Apache mod_auth_digest: DoS attackCVE-2026-73637Discovered Published CVE-2026-73637high7.36 min
Apache mod_auth_digest: one-time-nonce replay attackCVE-2026-73636Discovered Published CVE-2026-73636high8.15 min
Apache mod_auth_digest: reauthentication attackCVE-2026-48005Discovered Published CVE-2026-48005high7.54 min
Apache mod_charset_lite: heap overflow in finish_partial_charCVE-2026-56153Discovered Published CVE-2026-56153high7.56 min
Apache mod_dav_fs: namespace overflowCVE-2026-93546Discovered Published CVE-2026-93546high8.86 min
Apache mod_dav_fs: property database read accessCVE-2026-58415Discovered Published CVE-2026-58415medium5.36 min
Apache mod_dav: shared lock overflowCVE-2026-42528Discovered Published CVE-2026-42528medium4.36 min
Apache mod_heartmonitor: denial of serviceCVE-2026-46729Discovered Published CVE-2026-46729high7.56 min
Apache mod_http2: denial of serviceCVE-2026-49975Discovered Published CVE-2026-49975high7.54 min
Apache mod_http2: memory corruption when file handles exhaustedCVE-2026-48913Discovered Published CVE-2026-48913high7.34 min
Apache mod_http2: use-after-free via shared session bbtmp re-entrancyCVE-2026-57941Discovered Published CVE-2026-57941critical9.86 min
Apache mod_proxy_ftp: PASV address handlingCVE-2026-63045Discovered Published CVE-2026-63045high7.56 min
Apache mod_proxy_html: crash in dump_contentCVE-2026-56449Discovered Published CVE-2026-56449high7.56 min
Apache mod_proxy_uwsgi: Transfer-Encoding response smugglingCVE-2026-63718Discovered Published CVE-2026-63718high7.56 min
Apache mod_rewrite: use-after-free via URL-encoded LA-U lookahead markerCVE-2026-56154Discovered Published CVE-2026-56154critical9.86 min
Apache mod_session: cookie not removed during internal redirectCVE-2026-47360Discovered Published CVE-2026-47360high7.55 min
Apache mod_ssl: SSLRequire allows .htaccess ap_expr file-functionCVE-2026-59797Discovered Published CVE-2026-59797critical9.86 min
Apache mod_ssl: stack buffer over-read in OCSP send_requestCVE-2026-44185Discovered Published CVE-2026-44185high7.36 min
Apache mod_userdir: information disclosureCVE-2026-79768Discovered Published CVE-2026-79768medium5.36 min
Apache mod_vhost_alias: stack overflowCVE-2026-63292Discovered Published CVE-2026-63292high7.56 min
Apache mod_xml2enc: crash on charset conversion failureCVE-2026-63686Discovered Published CVE-2026-63686high7.56 min
Apache mod_xml2enc: heap overflowCVE-2026-42536Discovered Published CVE-2026-42536high7.56 min
Hydro @hydrooj/ui-default stored XSS via commentCVE-2026-126800Discovered Published CVE-2026-126800critical9.36 min
ideon SSRF protection bypass via IPv6 transition addressesCVE-2026-103980Discovered Published CVE-2026-103980high7.16 min
OpsTree REMS authentication bypass on the reports APICVE-2026-126768Discovered Published CVE-2026-126768critical9.36 min
OpsTree REMS missing authentication on the config APICVE-2026-126769Discovered Published CVE-2026-126769high8.76 min
pappl-retrofit directory traversal in add-ppdfiCVE-2026-123747Discovered Published CVE-2026-123747high7.36 min
Portabase unauthenticated path traversal in TUS web endpointCVE-2026-67449Discovered Published CVE-2026-67449critical9.86 min
Red Hat Quay SQL LIKE wildcard injection in robot listCVE-2026-110697Discovered Published CVE-2026-110697critical9.96 min
Traccar authentication bypass via crafted email parameterCVE-2026-126777Discovered Published CVE-2026-126777critical9.16 min
WWBN AVideo path traversal file readCVE-2026-126804Discovered Published CVE-2026-126804high7.26 min
WWBN AVideo stored XSS via video nameCVE-2026-126806Discovered Published CVE-2026-126806critical9.36 min
ADAudit Plus authenticated SQL injectionCVE-2026-12062Discovered Published CVE-2026-12062high8.89 min
ADAudit Plus second-order SQLiCVE-2026-76981Discovered Published CVE-2026-76981high8.89 min
Adobe Commerce template engine RCECVE-2026-75650Discovered Published CVE-2026-75650critical10.0Known exploited9 min
Adobe Commerce unrestricted file uploadCVE-2026-48356Discovered Published CVE-2026-48356critical9.3Known exploited10 min
AhsayCBS system password-check bypassCVE-2026-105133Discovered Published CVE-2026-105133medium6.9Known exploited9 min
AhsayCBS UpdateReceivers.do OS command injectionCVE-2026-105134Discovered Published CVE-2026-105134critical10.0Known exploited9 min
Apache Doris JDBC URL RCECVE-2026-96443Discovered Published CVE-2026-96443medium6.59 min
Apache FOP: unsafe deserialization in hyphenation loadingCVE-2026-71395Discovered Published CVE-2026-71395Unrated6 min
Apache HTTP Server: mod_http2 heap corruption and RCE in assign_headersCVE-2026-119618Discovered Published CVE-2026-119618Unrated6 min
Apache HTTP Server: mod_md NULL pointer dereference leads to child process crashCVE-2026-106023Discovered Published CVE-2026-106023Unrated6 min
Apache HTTP Server: mod_vhost_alias 1-byte stack buffer overwriteCVE-2026-109163Discovered Published CVE-2026-109163Unrated6 min
Apache NiFi H2 connection URL code injectionCVE-2023-34468Discovered Published CVE-2023-34468high8.810 min
Apache XML Graphics Batik: xml:base same-origin bypassCVE-2026-49236Discovered Published CVE-2026-49236Unrated6 min
Apache XML Graphics Batik: XSS via unencoded SVGFont metadataCVE-2026-40853Discovered Published CVE-2026-40853Unrated6 min
Arris VAP2500 command injectionCVE-2024-5196Discovered Published CVE-2024-5196medium5.16 min
Atlassian Data Center unauthenticated root-directory file accessCVE-2026-21589Discovered Published CVE-2026-21589critical9.3Known exploited11 min
Barracuda timezone-setting OS command injectionCVE-2026-111560Discovered Published CVE-2026-111560high8.6Known exploited10 min
BeyondTrust unvalidated message origin file operationsCVE-2026-102764Discovered Published CVE-2026-102764critical9.3Known exploited9 min
Check Point path traversal information disclosureCVE-2024-24919Discovered Published CVE-2024-24919high8.6Known exploited9 min
Cisco BroadWorks OCI XML parser file disclosureCVE-2026-20320Discovered Published CVE-2026-20320high7.5Known exploited9 min
code-graph-rag MCP read_file pagination traversalCVE-2026-77604Discovered Published CVE-2026-77604high7.59 min
Collabora Online proxy.php OS command injectionCVE-2026-110447Discovered Published CVE-2026-110447critical9.2Known exploited9 min
Craft CMS search SQL injectionCVE-2026-123488Discovered Published CVE-2026-123488critical9.39 min
GetPaid payment bypass via fractional quantityCVE-2026-123668Discovered Published CVE-2026-123668medium5.39 min
Gitea diffpatch API git-hook executionCVE-2026-60004Discovered Published CVE-2026-60004critical9.8Known exploited10 min
GitLab CI/CD regex handling remote code executionCVE-2026-97229Discovered Published CVE-2026-97229critical10.0Known exploited10 min
GPUStack loopback trust via forged source-IP headerCVE-2026-102895Discovered Published CVE-2026-102895critical9.8Known exploited11 min
graphql-tools mergeIncrementalResult prototype pollutionCVE-2026-114604Discovered Published CVE-2026-114604high8.410 min
hMailServer JSON-reader complexity DoSCVE-2026-126623Discovered Published CVE-2026-126623high7.510 min
IBM Aspera Faspex crafted-message authorization bypassCVE-2026-123218Discovered Published CVE-2026-123218critical9.8Known exploited9 min
IBM WebSphere SSRFCVE-2026-9667Discovered Published CVE-2026-9667medium5.39 min
Ivanti EPM Core API SQL injectionCVE-2026-121653Discovered Published CVE-2026-121653critical9.810 min
Ivanti predictable-filename uploadCVE-2026-118527Discovered Published CVE-2026-118527medium4.3Known exploited9 min
Jenkins CLI arbitrary file readCVE-2024-23897Discovered Published CVE-2024-23897critical9.8Known exploited18 min
JFrog Artifactory token-scope confusionCVE-2026-42016Discovered Published CVE-2026-42016high8.1Known exploited9 min
Langflow stored-flow replacementCVE-2026-33017Discovered Published CVE-2026-33017critical9.3Known exploited18 min
LiteLLM SQLi via spend logsCVE-2024-5225Discovered Published CVE-2024-5225medium6.46 min
Log4j JNDI lookupCVE-2021-44228Discovered Published CVE-2021-44228critical10.0Known exploited20 min
Mattermost board channelId permission bypassCVE-2026-9859Discovered Published CVE-2026-9859medium6.59 min
MLflow dspy pickle deserialization bypassCVE-2026-96775Discovered Published CVE-2026-96775high8.89 min
Mongoose data-merge prototype pollutionCVE-2026-125117Discovered Published CVE-2026-125117high8.210 min
n8n public-form file-provenance bypassCVE-2026-21858Discovered Published CVE-2026-21858critical10.018 min
ND Shortcodes XSS via uploaderCVE-2024-5220Discovered Published CVE-2024-5220medium6.46 min
Next.js middleware authentication bypassCVE-2025-29927Discovered Published CVE-2025-29927critical9.118 min
NotificationX unauth shortcode executionCVE-2026-119302Discovered Published CVE-2026-119302medium6.59 min
OpenAM jato.clientSession pre-auth deserialization RCECVE-2026-33439Discovered Published CVE-2026-33439critical9.310 min
OpenSSH password authentication bypassCVE-2026-123158Discovered Published CVE-2026-123158high8.1Known exploited14 min
Openwave Webtop transcoder file-type bypassCVE-2026-111793Discovered Published CVE-2026-111793medium4.3Known exploited9 min
PHP cross-request state confusionCVE-2026-109619Discovered Published CVE-2026-109619critical9.2Known exploited12 min
PHP request-shutdown memory defectCVE-2026-109618Discovered Published CVE-2026-109618critical9.2Known exploited12 min
Plex Media Server url-parameter traversalCVE-2026-96651Discovered Published CVE-2026-96651medium6.59 min
Plex timeline SSRF to loopback agentCVE-2026-96654Discovered Published CVE-2026-96654medium6.9Known exploited9 min
Plex token SSRF to arbitrary destinationsCVE-2026-96652Discovered Published CVE-2026-96652medium4.3Known exploited9 min
Plex transcode-endpoint SSRFCVE-2026-96655Discovered Published CVE-2026-96655medium4.3Known exploited9 min
Plex TranscoderH264Options codec writeCVE-2026-96656Discovered Published CVE-2026-96656high8.6Known exploited9 min
PostX XSS via file uploadCVE-2024-5223Discovered Published CVE-2024-5223medium6.46 min
Primary Addon for Elementor stored XSSCVE-2024-5229Discovered Published CVE-2024-5229medium6.46 min
privateGPT SSRF via file uploadCVE-2024-5186Discovered Published CVE-2024-5186high8.36 min
ProfilePress member-directory role bypassCVE-2026-123659Discovered Published CVE-2026-123659medium5.39 min
Qi Blocks XSS via uploaderCVE-2024-5221Discovered Published CVE-2024-5221medium6.46 min
Rails Active Storage ImageMagick coder abuseCVE-2026-126082Discovered Published CVE-2026-126082critical9.88 min
Reachy Mini unauth app-install RCECVE-2026-96455Discovered Published CVE-2026-96455high8.89 min
React Server Components decoderCVE-2025-55182Discovered Published CVE-2025-55182critical10.0Known exploited8 min
React Server Components unauthenticated RCECVE-2026-126187Discovered Published CVE-2026-126187critical9.519 min
Report-Info path traversal file readCVE-2024-5273Discovered Published CVE-2024-5273medium4.36 min
Reviews & Rating XSS via uploadCVE-2024-5218Discovered Published CVE-2024-5218medium6.46 min
Signal K resources API traversalCVE-2026-123807Discovered Published CVE-2026-123807critical9.810 min
SiteGuard Server statistics command injectionCVE-2026-106931Discovered Published CVE-2026-106931high7.8Known exploited9 min
SonicOS SSLVPN SAML enforcement bypass via alternate authenticationCVE-2026-19868Discovered Published CVE-2026-19868high7.5Known exploited7 min
Spasalon theme: CSRF on theme optionsCVE-2026-125843Discovered Published CVE-2026-125843high8.87 min
SSRF in Apache BatikCVE-2026-44929Discovered Published CVE-2026-44929Unrated6 min
Swiss Toolkit admin auth bypassCVE-2024-5204Discovered Published CVE-2024-5204high8.86 min
Tomcat partial-PUT path traversalCVE-2025-24813Discovered Published CVE-2025-24813critical10.0Known exploited18 min
TP-Link PPTP VPN command injectionCVE-2024-5227Discovered Published CVE-2024-5227high7.56 min
Unauthenticated Payment Status Manipulation in Sipay's WooCommerce moduleCVE-2026-85632Discovered Published CVE-2026-85632critical9.16 min
VeloCloud Orchestrator operator escalationCVE-2026-114625Discovered Published CVE-2026-114625critical9.9Known exploited9 min
Videojs HTML5 shortcode XSSCVE-2024-5205Discovered Published CVE-2024-5205medium6.46 min
webriti ElitePress theme: CSRF on theme optionsCVE-2026-125839Discovered Published CVE-2026-125839high8.87 min
webriti Heroic theme: CSRF on theme optionsCVE-2026-125841Discovered Published CVE-2026-125841high8.86 min
webriti Quality theme: CSRF on theme optionsCVE-2026-125838Discovered Published CVE-2026-125838high8.87 min
webriti Rambo theme: CSRF on theme optionsCVE-2026-125840Discovered Published CVE-2026-125840high8.87 min
webriti Wallstreet Agency theme: CSRF on theme optionsCVE-2026-125842Discovered Published CVE-2026-125842high8.87 min
WooCommerce paid-option surcharge bypassCVE-2026-119171Discovered Published CVE-2026-119171medium5.39 min
WordPress REST batch route confusion chained to SQL injectionCVE-2026-63030Discovered Published CVE-2026-63030critical9.8Known exploited10 min
WordPress School Management ERP SQL injectionCVE-2026-9767Discovered Published CVE-2026-9767medium6.59 min
ZTE SCP SQL injectionCVE-2026-9668Discovered Published CVE-2026-9668medium6.39 min