datacycle-engine dataCycle-CORE vulnerabilities

Latest datacycle-engine dataCycle-CORE CVEs

Newest publication first

1. CVE-2026-32825 dataCycle No Brute-Force Protection On Web And API Login Endpoints

   Published 2026-07-20

   High·CVSS 7.3 EPSS 0.34%

   dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses a...

2. CVE-2026-32824 dataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect Targets

   Published 2026-07-20

   High·CVSS 7.3 EPSS 0.34%

   dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply f...

3. CVE-2026-32823 dataCycle State-Changing GET Endpoints Enable CSRF

   Published 2026-07-20

   Medium·CVSS 4.3 EPSS 0.14%

   dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes th...

4. CVE-2026-32821 API Collection Impersonation Via user_email And Missing Object- Level Authorization

   Published 2026-07-20

   High·CVSS 8.1 EPSS 0.35%

   dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access...

5. CVE-2026-32806 dataCycle Authorization Bypass Via /remote_render

   Published 2026-07-20

   High·CVSS 7.5 EPSS 0.39%

   dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partial...

6. CVE-2026-32820 dataCycle Public Markdown Path Traversal Via /docs/*path

   Published 2026-07-20

   High·CVSS 7.5 EPSS 0.89%

   dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the documentation and static markdown renderer accep...

7. CVE-2026-32819 dataCycle User Directory Enumeration Via /users/search

   Published 2026-07-20

   Medium·CVSS 4.3 EPSS 0.27%

   dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and...

8. CVE-2026-32822 dataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public Pages

   Published 2026-07-20

   Medium·CVSS 6.1 EPSS 0.27%

   dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTM...

9. CVE-2026-32807 dataCycle Public DataLink Text File Download Ignores Validity And Authorization

   Published 2026-07-20

   High·CVSS 7.5 EPSS 0.39%

   dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.