Syed Balkhi has 4 CVEs on record. 4 were published in the last 90 days. The median CVSS is 7.3 (high).
CVEs per month
Last 12 months, by publish date
1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- Envira Gallery 1
- charitable 1
- easy-digital-downloads 1
- nextgen-gallery 1
4
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-95522High· 7.6Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.42CVE-2026-94123High· 7.5Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.41CVE-2026-104394High· 7.1Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.39CVE-2026-104079Medium· 4.3Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabil…36
Syed Balkhi vulnerabilities
CVEs affecting Syed Balkhi, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-104079Medium· 4.3PoCEnvira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabil…
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabil…
▾ TwilightSyed Balkhi · Envira GalleryEPSS 0.19%via NVD
CVE-2026-104394High· 7.1Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
▾ TwilightSyed Balkhi · charitableEPSS 0.23%via NVD
CVE-2026-94123High· 7.5Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
▾ TwilightSyed Balkhi · nextgen-galleryEPSS 0.39%via NVD
CVE-2026-95522High· 7.6Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
▾ TwilightSyed Balkhi · easy-digital-downloadsEPSS 0.38%via NVD