CVEs
[CVSS 8.7 High] CVE-2026-55872 — Stored XSS in GYM-One v1.4.0
[CVSS 6.5 Medium] CVE-2026-55871 — SQL Injection in GYM-One v1.4.0
[CVSS 9.8 Critical] CVE-XXXX-XXXXX — Auth Bypass in Raspberry Pi Dashboard
[CVSS 9.8 Critical] CVE-XXXX-XXXXX — OS Command Injection in Raspberry Pi Dashboard
Trash CVEs
Low-quality findings in low-quality projects with at least a few hundred stars. Details withheld pending CVE assignment.
Pending - [CVSS 9.8 Critical] SQL Injection (Unauthenticated)
Pending - [CVSS 9.8 Critical] SQL Injection Authentication Bypass
Pending - [CVSS 9.8 Critical] Unauthenticated SQL Injection
Pending - [CVSS 9.3 Critical] Unauthenticated Reflected XSS
Pending - [CVSS 7.4 High] MD5 Magic Hash Type Juggling
Pending - [CVSS 7.2 High] SQL Injection (Authenticated Admin)
Pending - [CVSS 6.5 Medium] Arbitrary File Deletion via SQL Injection Chain
Pending - [CVSS 6.1 Medium] Reflected XSS
Pending - [CVSS 5.4 Medium] Stored XSS via Product Reviews
Pending / Not Yet Disclosed
Findings reported to vendors. Details withheld pending CVE assignment and coordinated disclosure.
Pending - [CVSS 8.7 High] Off-by-One Heap Buffer Overflow
Pending - [CVSS 8.1 High] Argument Injection