Product by Decolua

    9Router

    26 known vulnerabilities in 9Router (Decolua), 0 of them actively exploited (CISA KEV).

    Key figures

    26

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in 9Router (Decolua)
    CriticalCVE-2026-62327

    9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

    		9.1
    HighCVE-2026-55638

    9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

    		8.6
    CriticalCVE-2026-46339

    9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

    		10.0
    CriticalCVE-2026-59801

    9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

    		9.8
    CriticalCVE-2026-59800

    9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint

    		9.8
    CriticalCVE-2026-63732

    9router before 0.4.60 Remote Code Execution via default password

    		9.9
    HighCVE-2026-56681

    9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

    		7.3
    HighCVE-2026-62312

    9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments

    		8.8
    CriticalCVE-2026-49352

    9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

    		9.8
    CriticalCVE-2026-55500

    9Router: Exposure of Sensitive Information to an Unauthorized Actor

    		9.9
    HighCVE-2026-62328

    9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints

    		7.5
    HighCVE-2026-56675

    9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs

    		8.3
    HighCVE-2026-72860

    9Router: Server-Side Request Forgery (SSRF)

    		8.5
    HighCVE-2026-56677

    9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

    		8.6
    HighCVE-2026-56679

    9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

    		—
    HighCVE-2026-63313

    9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch

    		7.7
    HighCVE-2026-103530

    decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

    		7.3
    MediumCVE-2026-56682

    9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

    		5.3
    HighCVE-2026-108593

    9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint

    		6.4
    HighCVE-2026-55641

    9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

    		8.2
    HighCVE-2026-55501

    9router: Login brute-force protection bypass via spoofed X-Forwarded-For header

    		7.3
    HighCVE-2026-49353

    9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

    		7.5
    HighCVE-2026-5842

    decolua 9router Administrative API Endpoint api authorization

    		7.3
    HighCVE-2026-56676

    9router: Image prefetch DNS rebinding allows SSRF to internal services

    		7.4
    MediumCVE-2026-56678

    9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

    		6.4

    All vulnerabilities in search

    All products by Decolua