Skip to content
OpenAdvisories

Vendor

dfpc-coe

2 known vulnerabilities.

Products

CloudTAK 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.6
    CVE-2026-55177

    CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard

    CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family (api/routes/esri.ts) takes a fully attacker-controlled URL from the request (POST /api/esr…

    dfpc-coe CloudTAK @tak-ps/cloudtak npm