All 4 CVE vulnerabilities found in semaphore, with AI-generated Chinese analysis, references, and POCs.
Vendor: semaphoreui
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-91994 | Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests CWE-862 | 6.5 | Medium | 2026-09-15 |
| CVE-2026-73294 | Semaphore U: OS Command Injection CWE-78 | 9.9 | Critical | 2026-08-12 |
| CVE-2026-73293 | Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision CWE-269 | 8.8 | High | 2026-08-12 |
| CVE-2026-73292 | Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation CWE-352 | 8.3 | High | 2026-08-12 |
All 4 known CVE vulnerabilities affecting semaphore with full Chinese analysis, references, and POCs where available.