Thoropass
2026
- CVE-2026-82802: Unauthenticated Response-Reflecting SSRF in NASA Earthdata Search (OpenSearch granule endpoint) Aug 31
- CVE-2026-82801: Unauthenticated SSRF and Internal Host Discovery in NASA Earthdata Search Aug 31
- CVE-2026-12188: grit42 — SQL Injection in CSV Export Endpoint Jun 14
- CVE-2026-7681: COCO Annotator — Unauthenticated Dataset Modification via Missing Authentication May 3
- CVE-2026-7680: COCO Annotator — Path Traversal via Dataset Folder Parameter May 3
- CVE-2026-2109: COCO Annotator — Broken Function Level Authorization in Undo Endpoint Feb 7
- CVE-2026-2108: COCO Annotator — Unauthenticated Denial of Service via Task Queue Flood Feb 7
- CVE-2026-2064: i-Educar — Stored XSS via Profile Picture Upload Feb 6