CodeWithCJ has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 5.4 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-92263High· 7.2SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore52CVE-2026-113612Medium· 5.4SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint42CVE-2026-102923Medium· 5.4SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families30
CodeWithCJ vulnerabilities
CVEs affecting CodeWithCJ, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-113612Medium· 5.4PoCSparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from publ…
CVE-2026-102923Medium· 5.4SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in…
CVE-2026-92263High· 7.2PoCSparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploa…