| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-33623 | PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution | pinchtab | pinchtab | Medium | 6.7 | 2026-03-26 20:47:06 | Deep Dive |
| CVE-2026-33622 | A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution | pinchtab | pinchtab | 中危 | - | 2026-03-26 20:44:48 | Deep Dive |
| CVE-2026-33621 | PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token | pinchtab | pinchtab | Medium | 4.8 | 2026-03-26 20:42:13 | Deep Dive |
| CVE-2026-33620 | PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems | pinchtab | pinchtab | Medium | 4.3 | 2026-03-26 20:40:27 | Deep Dive |
| CVE-2026-33619 | PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl | pinchtab | pinchtab | Medium | 4.1 | 2026-03-26 20:34:02 | Deep Dive |
| CVE-2026-33081 | PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation | pinchtab | pinchtab | Medium | 5.8 | 2026-03-20 09:05:02 | Deep Dive |
| CVE-2026-30834 | PinchTab: SSRF with Full Response Exfiltration via Download Handler | pinchtab | pinchtab | High | 7.5 | 2026-03-07 15:36:30 | Deep Dive |