WA
Vendor
warp-tech
8
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-91167 | WA warpgate warp-tech | 6.0 | Sep 21 | Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary |
| CVE-2026-91166 | WA warpgate warp-tech | 5.7 | Sep 21 | Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target |
| CVE-2026-91165 | WA warpgate warp-tech | 2.4 | Sep 21 | Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values |
| CVE-2026-91164 | WA warpgate warp-tech | 4.3 | Sep 21 | Warpgate: API tokens bypass the user's allowed_ip_ranges restriction |
| CVE-2026-63330 | WA warpgate warp-tech | 7.7 | Sep 21 | Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions |
| CVE-2026-63329 | WA warpgate warp-tech | 4.9 | Sep 21 | Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets |
| CVE-2026-58491 | WA warpgate warp-tech | 9.3 | Sep 21 | Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter |
| CVE-2026-44347 | WA warpgate warp-tech | 6.5 | May 12 | Warpgate: SSO CSRF -- State Token Not Validated on Return |