What’s Vulnerable › Products

xyproto algernon vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your xyproto algernon version is affected

Latest xyproto algernon vulnerabilities

• CVE-2026-52792 — Algernon: Server-side script source disclosure on Windows via NTFS filename (CVSS 8.7)
• CVE-2026-48126 — Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir (CVSS 8.2)
• CVE-2026-46431 — Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * (CVSS 4.3)
• CVE-2026-46430 — Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS (CVSS 4.3)
• CVE-2026-45728 — Algernon: Single-file mode unconditionally enables debug mode (CVSS 7.5)
• CVE-2026-45721 — Algernon: handler.lua discovery walks parent directories above the server root (CVSS 9.0)
• CVE-2026-43982 — Algernon: Path traversal file write via savein() (CVSS 8.7)
• CVE-2026-43981 — Algernon: Race Condition in handle() shared LState (CVSS 8.2)