Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

decolua — Vulnerabilities & Security Advisories 26

Browse all 26 CVE security advisories affecting decolua. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page details known vulnerabilities associated with the decolua vendor and its software products. It aggregates data related to various weakness types, including buffer overflows, insecure configurations, and input validation flaws. The content covers security issues identified from the early 2020s through recent months, providing a historical perspective on the stability and security posture of the vendor's offerings. Here, you can discover how decolua responds to emerging threats by tracking its security advisories and patch release cycles. The collection allows users to understand the prevalence and severity of specific weakness classes within this particular software ecosystem. By examining this data, you can look up a product's vulnerability history to assess long-term maintenance quality and risk exposure. This resource serves as a centralized reference for security researchers, system administrators, and compliance officers who need to evaluate the technical debt and remediation speed of decolua components. The information is compiled from public disclosures and official statements, ensuring that the recorded weaknesses reflect verified reports rather than speculative findings. This structured approach helps in comparing the security trajectory of decolua against industry benchmarks. Users can identify patterns in bug fixes and determine if certain modules are more prone to exploitation than others. The goal is to provide a clear, factual overview that aids in making informed decisions about the adoption or continued use of decolua solutions in enterprise environments.

Top products by decolua: 9router
CVE ID Title CVSS Severity Published
CVE-2026-108593 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint — 9router CWE-94 6.4 Medium 2026-10-10
CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery — 9Router CWE-918 7.3 High 2026-09-30
CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header — 9router CWE-307 5.3 Medium 2026-09-22
CVE-2026-56681 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header — 9router CWE-807 7.3 High 2026-09-22
CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable — 9router CWE-918 8.5 High 2026-08-20
CVE-2026-56677 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint — 9router CWE-306 8.6 High 2026-08-17
CVE-2026-63313 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch — 9router CWE-918 7.7 High 2026-07-23
CVE-2026-63732 9router before 0.4.60 Remote Code Execution via default password — 9router CWE-78 9.9 Critical 2026-07-23
CVE-2026-62312 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments — 9router CWE-78 8.8 High 2026-07-15
CVE-2026-56678 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding — 9router CWE-20 6.4 Medium 2026-07-15
CVE-2026-56679 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade — 9router CWE-915 - - 2026-07-15
CVE-2026-49353 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING — 9router CWE-290 7.5 High 2026-07-15
CVE-2026-49352 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass — 9router CWE-798 9.8 Critical 2026-07-15
CVE-2026-46339 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes — 9router CWE-78 10.0 Critical 2026-07-15
CVE-2026-62328 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints — 9Router CWE-862 7.5 High 2026-07-13
CVE-2026-62327 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats — 9Router CWE-306 9.1 Critical 2026-07-13
CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers — 9Router CWE-306 9.8 Critical 2026-07-13
CVE-2026-56675 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs — 9router CWE-287 8.3 High 2026-07-10
CVE-2026-55638 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass — 9router CWE-862 8.6 High 2026-07-10
CVE-2026-55641 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF — 9router CWE-290 8.2 High 2026-07-10
CVE-2026-56676 9router: Image prefetch DNS rebinding allows SSRF to internal services — 9router CWE-367 7.4 High 2026-07-10
CVE-2026-55500 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover — 9router CWE-200 9.9 Critical 2026-07-10
CVE-2026-55501 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header — 9router CWE-307 7.3 High 2026-07-10
CVE-2026-59800 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint — 9router CWE-78 9.8 Critical 2026-07-07
CVE-2026-10269 decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization — 9router CWE-285 6.3 Medium 2026-06-01
CVE-2026-5842 decolua 9router Administrative API Endpoint api authorization — 9router CWE-639 7.3 High 2026-04-09

This page lists every published CVE security advisory associated with decolua. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.