Skip to content
OpenAdvisories

Product · CoreBunch

Instatic

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-121458

    Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

    Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling conten…

    CoreBunch Instatic
  • Medium 6.1
    CVE-2026-72587

    Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

    A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint.

    CoreBunch Instatic