dataCycle-CORE

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. dataCycle Public Markdown Path Traversal Via /docs/*pathCVE-2026-32820datacycle-engine · CVSS 7.5 · 0.9% likely

   CWE-22

2. dataCycle Public DataLink Text File Download Ignores Validity And AuthorizationCVE-2026-32807datacycle-engine · CVSS 7.5 · 0.4% likely

   CWE-285

3. dataCycle Authorization Bypass Via /remote_renderCVE-2026-32806datacycle-engine · CVSS 7.5 · 0.4% likely

   CWE-285

4. API Collection Impersonation Via user_email And Missing Object- Level AuthorizationCVE-2026-32821datacycle-engine · CVSS 8.1 · 0.4% likely

   CWE-285

5. dataCycle No Brute-Force Protection On Web And API Login EndpointsCVE-2026-32825datacycle-engine · CVSS 7.3 · 0.3% likely

   CWE-307

6. dataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect TargetsCVE-2026-32824datacycle-engine · CVSS 7.3 · 0.3% likely

   CWE-601

7. dataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public PagesCVE-2026-32822datacycle-engine · CVSS 6.1 · 0.3% likely

   CWE-80

8. dataCycle User Directory Enumeration Via /users/searchCVE-2026-32819datacycle-engine · CVSS 4.3 · 0.3% likely

   CWE-285

9. dataCycle State-Changing GET Endpoints Enable CSRFCVE-2026-32823datacycle-engine · CVSS 4.3 · 0.1% likely

   CWE-352

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.