Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Unclecode CVE-2026-119122
Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enab
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Unclecode CVE-2026-119121
Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary J
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Unclecode CVE-2026-119120
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to c
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Unclecode CVE-2026-119119
Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, me
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Unclecode CVE-2026-119118
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launch
0 CVEs and 0 credit lines.
-
Unclecode CVE-2026-115508
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients t
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit
-
Unclecode CVE-2026-112363
Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit
-
Unclecode CVE-2026-109239
Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker ser
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Unclecode CVE-2026-109238
Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_co
0 CVEs and 0 credit lines.
-
Unclecode CVE-2026-109237
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping th
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit
-
Unclecode unclecode-2026-10
Unclecode Security Releases - October 2026
4 CVEs and 4 credit lines. None claimed yet.
0 of 4 credit lines claimed Claim credit