All 7 CVE vulnerabilities found in pinchtab, with AI-generated Chinese analysis, references, and POCs.
Vendor: pinchtab
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-33623 | PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution CWE-78 | 6.7 | Medium | 2026-03-26 |
| CVE-2026-33622 | A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution CWE-94 | 6.3 | - | 2026-03-26 |
| CVE-2026-33621 | PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token CWE-290 | 4.8 | Medium | 2026-03-26 |
| CVE-2026-33620 | PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems CWE-598 | 4.3 | Medium | 2026-03-26 |
| CVE-2026-33619 | PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl CWE-918 | 4.1 | Medium | 2026-03-26 |
| CVE-2026-33081 | PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation CWE-918 | 5.8 | Medium | 2026-03-20 |
| CVE-2026-30834 | PinchTab: SSRF with Full Response Exfiltration via Download Handler CWE-918 | 7.5 | High | 2026-03-07 |
All 7 known CVE vulnerabilities affecting pinchtab with full Chinese analysis, references, and POCs where available.