synapps_runtime vulnerabilities
CVEs whose affected-version data names the synapps_runtime package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-7004Medium· 6.1PoCWIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter t…
CVE-2026-7005Medium· 6.1PoCWIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue dis…
CVE-2026-7003Medium· 5.3WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in…