# cve.now: Decolua

The newest entries naming Decolua as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108593](https://cve.now/CVE-2026-108593.md): 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint (CVSS 7.3)
- [CVE-2026-103530](https://cve.now/CVE-2026-103530.md): decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery (CVSS 6.9)
- [CVE-2026-56682](https://cve.now/CVE-2026-56682.md): 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header (CVSS 5.3)
- [CVE-2026-56681](https://cve.now/CVE-2026-56681.md): 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header (CVSS 7.3)
- [CVE-2026-72860](https://cve.now/CVE-2026-72860.md): 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable (CVSS 8.5)
- [CVE-2026-56677](https://cve.now/CVE-2026-56677.md): 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint (CVSS 8.6)
- [CVE-2026-63732](https://cve.now/CVE-2026-63732.md): 9router before 0.4.60 Remote Code Execution via default password (CVSS 9.4)
- [CVE-2026-63313](https://cve.now/CVE-2026-63313.md): 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch (CVSS 8.3)
- [CVE-2026-62312](https://cve.now/CVE-2026-62312.md): 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments (CVSS 8.8)
- [CVE-2026-56678](https://cve.now/CVE-2026-56678.md): 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding (CVSS 6.4)
- [CVE-2026-56679](https://cve.now/CVE-2026-56679.md): 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade (CVSS 8.7)
- [CVE-2026-49353](https://cve.now/CVE-2026-49353.md): 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING (CVSS 7.5)
- [CVE-2026-49352](https://cve.now/CVE-2026-49352.md): 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass (CVSS 9.8)
- [CVE-2026-46339](https://cve.now/CVE-2026-46339.md): 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes (CVSS 10.0)
- [CVE-2026-62328](https://cve.now/CVE-2026-62328.md): 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints (CVSS 8.7)
- [CVE-2026-62327](https://cve.now/CVE-2026-62327.md): 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats (CVSS 9.3)
- [CVE-2026-59801](https://cve.now/CVE-2026-59801.md): 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers (CVSS 9.3)
- [CVE-2026-56675](https://cve.now/CVE-2026-56675.md): 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs (CVSS 8.3)
- [CVE-2026-55638](https://cve.now/CVE-2026-55638.md): 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass (CVSS 8.6)
- [CVE-2026-55641](https://cve.now/CVE-2026-55641.md): 9router: Unauthenticated \`/v1\` proxy access via \`Host\`-header spoofing → open AI relay + SSRF (CVSS 8.2)
- [CVE-2026-56676](https://cve.now/CVE-2026-56676.md): 9router: Image prefetch DNS rebinding allows SSRF to internal services (CVSS 7.4)
- [CVE-2026-55500](https://cve.now/CVE-2026-55500.md): 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover (CVSS 9.9)
- [CVE-2026-55501](https://cve.now/CVE-2026-55501.md): 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header (CVSS 7.3)
- [CVE-2026-59800](https://cve.now/CVE-2026-59800.md): 9Router \< 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint (CVSS 9.2)
- [CVE-2026-10269](https://cve.now/CVE-2026-10269.md): decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization (CVSS 5.3)
- [CVE-2026-5842](https://cve.now/CVE-2026-5842.md): decolua 9router Administrative API Endpoint api authorization (CVSS 6.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/decolua
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.