CVE-2026-44828Critical· 9.3▾ MidnightQexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a val…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
— → 9.3
none → critical
Last analysed / modified upstream
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114195Medium· 5.3WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability
CVE-2026-112027Medium· 5.3cms: light0011 cms: Information disclosure via filename manipulation in Uploadify (CVE-2026-112027)
CVE-2026-109970Medium· 4.7A flaw was found in the clevis PKCS#11 pin
CVE-2026-96944Medium· 5.5Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.
CVE-2026-108937Medium· 5.3A vulnerability was detected in code-projects Online Ticket Reservation System 1.0
CVE-2026-106499Medium· 4.9Backstage is an open framework for building developer portals