AmentoTech has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 9.9 (critical), with 5 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-434 (3). Most affected products: taskbot (2), workreap_core (2), doctreat (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.9
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Worst active — by depth score
CVE-2026-39773Critical· 10.0Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.55CVE-2026-39770Critical· 10.0Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.55CVE-2026-39759Critical· 9.9Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.55CVE-2026-39757Critical· 9.9Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.55CVE-2026-39753Critical· 9.8Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.54
AmentoTech vulnerabilities
CVEs affecting AmentoTech, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-112822High· 8.5WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.
CVE-2026-39753Critical· 9.8Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
CVE-2026-39759Critical· 9.9Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
CVE-2026-39757Critical· 9.9Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
CVE-2026-39770Critical· 10.0Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
CVE-2026-39773Critical· 10.0Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.