CVE-2026-44828

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

• CWE-538

• https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33
• https://github.com/Qexo/Qexo/releases/tag/4.2.0
• https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232

Published

Oct 12, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44822Out-of-bounds read in Microsoft Office Excel allows an unaut…8.2
• CVE-2026-44823Numeric truncation error in Microsoft Office Excel allows an…7.8
• CVE-2026-44824Heap-based buffer overflow in Microsoft Office allows an una…7.8
• CVE-2026-44825Hardcoded credentials in the Basic Authentication setup tool…9.8
• CVE-2026-44826Vvveb is a powerful and easy to use CMS with page builder to…7.5
• CVE-2026-44827Diffusers is the a library for pretrained diffusion models.…8.8
• CVE-2026-44829Gotenberg is a Docker-powered stateless API for PDF files. I…8.8
• CVE-2026-4483An exposed IOCTL with an  insufficient access control vulner…7
• CVE-2026-44830Nocturne Memory is a lightweight, rollbackable, and visual L…8.7
• CVE-2026-44831Snipe-IT is an IT asset/license management system. Prior to …5.4
• CVE-2026-44832Snipe-IT is an IT asset/license management system. Prior to …8.8
• CVE-2026-44833Snipe-IT is an IT asset/license management system. Prior to …7.1