WIT has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.1 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
WIT vulnerabilities
CVEs affecting WIT, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-7004Medium· 6.1PoCWIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter t…
CVE-2026-7005Medium· 6.1PoCWIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue dis…
CVE-2026-7003Medium· 5.3WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in…