CVE-2026-3965

A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue. The identifier of the patch is 6bec52dca158481258315ba0fc2f11206df7b719. It is advisable to upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.

• CWE-693

• https://github.com/A7cc/cve/issues/6
• https://github.com/A7cc/cve/issues/6#issue-3999235307
• https://github.com/whyour/qinglong/
• https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719
• https://github.com/whyour/qinglong/pull/2941
• https://github.com/whyour/qinglong/releases/tag/v2.20.2
• https://vuldb.com/?ctiid.350394
• https://vuldb.com/?id.350394
• https://vuldb.com/?submit.768861

Published

Mar 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39644Missing Authorization vulnerability in Roxnor Wp Ultimate Re…5.3
• CVE-2026-39645Server-Side Request Forgery (SSRF) vulnerability in Global P…5.4
• CVE-2026-39646Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-39647Server-Side Request Forgery (SSRF) vulnerability in sonaar M…5.4
• CVE-2026-39648Missing Authorization vulnerability in themebeez Cream Blog …5.3
• CVE-2026-39649Missing Authorization vulnerability in themebeez Royale News…5.3
• CVE-2026-39650Missing Authorization vulnerability in Unitech Web UnitechPa…5.3
• CVE-2026-39651Missing Authorization vulnerability in TotalSuite Total Poll…6.5
• CVE-2026-39652Missing Authorization vulnerability in igms iGMS Direct Book…5.3
• CVE-2026-39653Missing Authorization vulnerability in Deepen Bajracharya Vi…4.3
• CVE-2026-39654Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2026-39655Missing Authorization vulnerability in TeconceTheme Mayosis …5.3