Security
فارسی
All products

github.com/pinchtab/pinchtab

Go · Package
7 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrlCVE-2026-33619 · GHSA-XQQ2-4J46-VWP7Version ranges need review. github.com/pinchtab/pinchtab Go Medium Fix reported
PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API TokenCVE-2026-33621 · GHSA-J65M-HV65-R264Version ranges need review. github.com/pinchtab/pinchtab Go Medium Fix reported
PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command ExecutionCVE-2026-33623 · GHSA-P8MM-644P-PHMHVersion ranges need review. github.com/pinchtab/pinchtab/cmd/pinchtabgithub.com/pinchtab/pinchtab Go Medium Fix reported
PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary SystemsCVE-2026-33620 · GHSA-MRQC-3276-74F8Version ranges need review. github.com/pinchtab/pinchtab Go Medium Fix reported
A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript ExecutionCVE-2026-33622 · GHSA-W5PC-M664-R62VVersion ranges need review. github.com/pinchtab/pinchtab/cmd/pinchtabgithub.com/pinchtab/pinchtab Go Medium No fix reported
PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validationCVE-2026-33081 · GHSA-QWXP-6QF9-WR4MVersion ranges need review. github.com/pinchtab/pinchtab Go Medium Fix reported
PinchTab has SSRF with Full Response Exfiltration via Download HandlerCVE-2026-30834 · GHSA-RW8P-C6HF-Q3PG github.com/pinchtab/pinchtab/cmd/pinchtabgithub.com/pinchtab/pinchtab Go High Fix reported