adminneo-org has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 7. The median CVSS is 7.5 (high). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Worst active — by depth score
CVE-2026-96633High· 8.1AdminNeo SQLite Database-List Drop Arbitrary File Deletion45CVE-2026-96631High· 8.2AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers45CVE-2026-96632HighAdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)41CVE-2026-59978High· 7.5AdminNeo: version-cache array injection causes persistent denial of service41CVE-2026-96630High· 7.2AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)40
adminneo-org vulnerabilities
CVEs affecting adminneo-org, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-96629Medium· 6.8AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
CVE-2026-96632HighAdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
CVE-2026-96630High· 7.2AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
CVE-2026-96634MediumAdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE
AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE
CVE-2026-96633High· 8.1AdminNeo SQLite Database-List Drop Arbitrary File Deletion
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
CVE-2026-96631High· 8.2AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
CVE-2026-59978High· 7.5AdminNeo: version-cache array injection causes persistent denial of service
AdminNeo: version-cache array injection causes persistent denial of service