Eden

Case studies

Explore Eden’s CVE remediation tests, what the controls blocked, and where coverage ends.

Urgency ranks known exploited CVEs first, then CVSS severity and score.

CVE remediation case studies
Adobe Commerce template engine RCECVE-2026-75650Discovered Published CVE-2026-75650critical10.0Known exploited5 min
AhsayCBS UpdateReceivers.do OS command injectionCVE-2026-105134Discovered Published CVE-2026-105134critical10.0Known exploited5 min
GitLab CI/CD regex handling remote code executionCVE-2026-97229Discovered Published CVE-2026-97229critical10.0Known exploited6 min
Log4j JNDI lookupCVE-2021-44228Discovered Published CVE-2021-44228critical10.0Known exploited9 min
React Server Components decoderCVE-2025-55182Discovered Published CVE-2025-55182critical10.0Known exploited5 min
Tomcat partial-PUT path traversalCVE-2025-24813Discovered Published CVE-2025-24813critical10.0Known exploited8 min
VeloCloud Orchestrator operator escalationCVE-2026-114625Discovered Published CVE-2026-114625critical9.9Known exploited6 min
Gitea diffpatch API git-hook executionCVE-2026-60004Discovered Published CVE-2026-60004critical9.8Known exploited6 min
GPUStack loopback trust via forged source-IP headerCVE-2026-102895Discovered Published CVE-2026-102895critical9.8Known exploited6 min
IBM Aspera Faspex crafted-message authorization bypassCVE-2026-123218Discovered Published CVE-2026-123218critical9.8Known exploited5 min
Jenkins CLI arbitrary file readCVE-2024-23897Discovered Published CVE-2024-23897critical9.8Known exploited8 min
WordPress REST batch route confusion chained to SQL injectionCVE-2026-63030Discovered Published CVE-2026-63030critical9.8Known exploited6 min
Adobe Commerce unrestricted file uploadCVE-2026-48356Discovered Published CVE-2026-48356critical9.3Known exploited6 min
Atlassian Data Center unauthenticated root-directory file accessCVE-2026-21589Discovered Published CVE-2026-21589critical9.3Known exploited6 min
BeyondTrust unvalidated message origin file operationsCVE-2026-102764Discovered Published CVE-2026-102764critical9.3Known exploited5 min
Langflow stored-flow replacementCVE-2026-33017Discovered Published CVE-2026-33017critical9.3Known exploited8 min
Collabora Online proxy.php OS command injectionCVE-2026-110447Discovered Published CVE-2026-110447critical9.2Known exploited5 min
PHP cross-request state confusionCVE-2026-109619Discovered Published CVE-2026-109619critical9.2Known exploited6 min
PHP request-shutdown memory defectCVE-2026-109618Discovered Published CVE-2026-109618critical9.2Known exploited7 min
Barracuda timezone-setting OS command injectionCVE-2026-111560Discovered Published CVE-2026-111560high8.6Known exploited6 min
Check Point path traversal information disclosureCVE-2024-24919Discovered Published CVE-2024-24919high8.6Known exploited5 min
Plex TranscoderH264Options codec writeCVE-2026-96656Discovered Published CVE-2026-96656high8.6Known exploited6 min
JFrog Artifactory token-scope confusionCVE-2026-42016Discovered Published CVE-2026-42016high8.1Known exploited6 min
OpenSSH password authentication bypassCVE-2026-123158Discovered Published CVE-2026-123158high8.1Known exploited10 min
SiteGuard Server statistics command injectionCVE-2026-106931Discovered Published CVE-2026-106931high7.8Known exploited6 min
Cisco BroadWorks OCI XML parser file disclosureCVE-2026-20320Discovered Published CVE-2026-20320high7.5Known exploited5 min
SonicOS SSLVPN SAML enforcement bypass via alternate authenticationCVE-2026-19868Discovered Published CVE-2026-19868high7.5Known exploited3 min
AhsayCBS system password-check bypassCVE-2026-105133Discovered Published CVE-2026-105133medium6.9Known exploited6 min
Plex timeline SSRF to loopback agentCVE-2026-96654Discovered Published CVE-2026-96654medium6.9Known exploited6 min
Ivanti predictable-filename uploadCVE-2026-118527Discovered Published CVE-2026-118527medium4.3Known exploited5 min
Openwave Webtop transcoder file-type bypassCVE-2026-111793Discovered Published CVE-2026-111793medium4.3Known exploited6 min
Plex token SSRF to arbitrary destinationsCVE-2026-96652Discovered Published CVE-2026-96652medium4.3Known exploited3 min
Plex transcode-endpoint SSRFCVE-2026-96655Discovered Published CVE-2026-96655medium4.3Known exploited6 min
n8n public-form file-provenance bypassCVE-2026-21858Discovered Published CVE-2026-21858critical10.08 min
Ivanti EPM Core API SQL injectionCVE-2026-121653Discovered Published CVE-2026-121653critical9.86 min
Rails Active Storage ImageMagick coder abuseCVE-2026-126082Discovered Published CVE-2026-126082critical9.86 min
Signal K resources API traversalCVE-2026-123807Discovered Published CVE-2026-123807critical9.86 min
React Server Components unauthenticated RCECVE-2026-126187Discovered Published CVE-2026-126187critical9.58 min
Craft CMS search SQL injectionCVE-2026-123488Discovered Published CVE-2026-123488critical9.36 min
OpenAM jato.clientSession pre-auth deserialization RCECVE-2026-33439Discovered Published CVE-2026-33439critical9.36 min
Next.js middleware authentication bypassCVE-2025-29927Discovered Published CVE-2025-29927critical9.18 min
Unauthenticated Payment Status Manipulation in Sipay's WooCommerce moduleCVE-2026-85632Discovered Published CVE-2026-85632critical9.12 min
ADAudit Plus authenticated SQL injectionCVE-2026-12062Discovered Published CVE-2026-12062high8.86 min
ADAudit Plus second-order SQLiCVE-2026-76981Discovered Published CVE-2026-76981high8.86 min
Apache NiFi H2 connection URL code injectionCVE-2023-34468Discovered Published CVE-2023-34468high8.86 min
MLflow dspy pickle deserialization bypassCVE-2026-96775Discovered Published CVE-2026-96775high8.86 min
Reachy Mini unauth app-install RCECVE-2026-96455Discovered Published CVE-2026-96455high8.86 min
Spasalon theme: CSRF on theme optionsCVE-2026-125843Discovered Published CVE-2026-125843high8.83 min
Swiss Toolkit admin auth bypassCVE-2024-5204Discovered Published CVE-2024-5204high8.82 min
webriti ElitePress theme: CSRF on theme optionsCVE-2026-125839Discovered Published CVE-2026-125839high8.83 min
webriti Heroic theme: CSRF on theme optionsCVE-2026-125841Discovered Published CVE-2026-125841high8.83 min
webriti Quality theme: CSRF on theme optionsCVE-2026-125838Discovered Published CVE-2026-125838high8.83 min
webriti Rambo theme: CSRF on theme optionsCVE-2026-125840Discovered Published CVE-2026-125840high8.83 min
webriti Wallstreet Agency theme: CSRF on theme optionsCVE-2026-125842Discovered Published CVE-2026-125842high8.83 min
graphql-tools mergeIncrementalResult prototype pollutionCVE-2026-114604Discovered Published CVE-2026-114604high8.46 min
privateGPT SSRF via file uploadCVE-2024-5186Discovered Published CVE-2024-5186high8.32 min
Mongoose data-merge prototype pollutionCVE-2026-125117Discovered Published CVE-2026-125117high8.26 min
code-graph-rag MCP read_file pagination traversalCVE-2026-77604Discovered Published CVE-2026-77604high7.56 min
hMailServer JSON-reader complexity DoSCVE-2026-126623Discovered Published CVE-2026-126623high7.56 min
TP-Link PPTP VPN command injectionCVE-2024-5227Discovered Published CVE-2024-5227high7.52 min
Apache Doris JDBC URL RCECVE-2026-96443Discovered Published CVE-2026-96443medium6.56 min
Mattermost board channelId permission bypassCVE-2026-9859Discovered Published CVE-2026-9859medium6.56 min
NotificationX unauth shortcode executionCVE-2026-119302Discovered Published CVE-2026-119302medium6.56 min
Plex Media Server url-parameter traversalCVE-2026-96651Discovered Published CVE-2026-96651medium6.56 min
WordPress School Management ERP SQL injectionCVE-2026-9767Discovered Published CVE-2026-9767medium6.56 min
LiteLLM SQLi via spend logsCVE-2024-5225Discovered Published CVE-2024-5225medium6.42 min
ND Shortcodes XSS via uploaderCVE-2024-5220Discovered Published CVE-2024-5220medium6.42 min
PostX XSS via file uploadCVE-2024-5223Discovered Published CVE-2024-5223medium6.42 min
Primary Addon for Elementor stored XSSCVE-2024-5229Discovered Published CVE-2024-5229medium6.42 min
Qi Blocks XSS via uploaderCVE-2024-5221Discovered Published CVE-2024-5221medium6.42 min
Reviews & Rating XSS via uploadCVE-2024-5218Discovered Published CVE-2024-5218medium6.42 min
Videojs HTML5 shortcode XSSCVE-2024-5205Discovered Published CVE-2024-5205medium6.42 min
ZTE SCP SQL injectionCVE-2026-9668Discovered Published CVE-2026-9668medium6.36 min
GetPaid payment bypass via fractional quantityCVE-2026-123668Discovered Published CVE-2026-123668medium5.36 min
IBM WebSphere SSRFCVE-2026-9667Discovered Published CVE-2026-9667medium5.33 min
ProfilePress member-directory role bypassCVE-2026-123659Discovered Published CVE-2026-123659medium5.36 min
WooCommerce paid-option surcharge bypassCVE-2026-119171Discovered Published CVE-2026-119171medium5.36 min
Arris VAP2500 command injectionCVE-2024-5196Discovered Published CVE-2024-5196medium5.12 min
Report-Info path traversal file readCVE-2024-5273Discovered Published CVE-2024-5273medium4.32 min
Apache FOP: unsafe deserialization in hyphenation loadingCVE-2026-71395Discovered Published CVE-2026-71395Unrated2 min
Apache HTTP Server: mod_http2 heap corruption and RCE in assign_headersCVE-2026-119618Discovered Published CVE-2026-119618Unrated2 min
Apache HTTP Server: mod_md NULL pointer dereference leads to child process crashCVE-2026-106023Discovered Published CVE-2026-106023Unrated2 min
Apache HTTP Server: mod_vhost_alias 1-byte stack buffer overwriteCVE-2026-109163Discovered Published CVE-2026-109163Unrated2 min
Apache XML Graphics Batik: xml:base same-origin bypassCVE-2026-49236Discovered Published CVE-2026-49236Unrated2 min
Apache XML Graphics Batik: XSS via unencoded SVGFont metadataCVE-2026-40853Discovered Published CVE-2026-40853Unrated2 min
SSRF in Apache BatikCVE-2026-44929Discovered Published CVE-2026-44929Unrated2 min