Skip to content
OpenAdvisories

Package · npm

@whyour/qinglong

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.3
    CVE-2026-55445

    Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication

    Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrit…

    whyour qinglong @whyour/qinglong npm
  • Medium 6.3
    CVE-2026-3965

    whyour qinglong API express.ts protection mechanism

    A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The…

    whyour qinglong @whyour/qinglong npm