Command and Code Injection

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks ParameterCVE-2026-26216unclecode · CVSS 10 · 6.3% likely

   CWE-94

2. Crawl4AI <= 0.8.6 - Remote Code ExecutionCVE-2026-53753unclecode · CVSS 9.8 · 2.4% likely

   CWE-94

3. Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_argsCVE-2026-57572unclecode · CVSS 10 · 0.9% likely

   CWE-88

4. Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_forCVE-2026-119121unclecode · CVSS 4.3 · 0.3% likely

   CWE-95

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.