What’s Vulnerable › Products

ExpressGateway express-gateway vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your ExpressGateway express-gateway version is affected

Latest ExpressGateway express-gateway vulnerabilities

• CVE-2026-107177 — Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens (CVSS 5.9)
• CVE-2026-107162 — Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass (CVSS 6.8)
• CVE-2025-9096 — ExpressGateway express-gateway REST Endpoint apps.js cross site scripting (CVSS 3.5)
• CVE-2025-9095 — ExpressGateway express-gateway REST Endpoint users.js cross site scripting (CVSS 3.5)