Spug vulnerabilities
CVEs whose affected-version data names the Spug package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-108540Critical· 9.9PoCA flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched r…
▾ AbyssalOpenSpug · SpugEPSS 1.7%via NVD
CVE-2026-90770High· 8.8Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation
Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions …
▾ Twilightopenspug · spugEPSS 1.3%via NVD