MEDIUM4.8Go
GHSA-j65m-hv65-r264· CVE-2026-33621, GO-2026-4821PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token
Modified: 3/27/2026
package
Go/github.com/pinchtab/pinchtab
pkg:go/github.com/pinchtab/pinchtab
MEDIUM4.3Go
GHSA-mrqc-3276-74f8· CVE-2026-33620, GO-2026-4822PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems
Modified: 3/27/2026
MEDIUM6.7Go
GHSA-p8mm-644p-phmh· CVE-2026-33623, GO-2026-4823PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution
Modified: 3/27/2026
MEDIUM5.8Go
GHSA-qwxp-6qf9-wr4m· CVE-2026-33081, GO-2026-4748PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation
Modified: 3/23/2026
MEDIUMGo
GHSA-w5pc-m664-r62v· CVE-2026-33622, GO-2026-4824A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution
Modified: 3/27/2026
MEDIUM4.1Go
GHSA-xqq2-4j46-vwp7· CVE-2026-33619, GO-2026-4825PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl
Modified: 5/5/2026
—Go
GO-2026-4631· CVE-2026-30834, GHSA-rw8p-c6hf-q3pgPinchTab has SSRF with Full Response Exfiltration via Download Handler in github.com/pinchtab/pinchtab
Modified: 3/23/2026
—Go
GO-2026-4748· CVE-2026-33081, GHSA-qwxp-6qf9-wr4mPinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation in github.com/pinchtab/pinchtab
Modified: 3/23/2026
—Go
GO-2026-4821· CVE-2026-33621, GHSA-j65m-hv65-r264PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token in github.com/pinchtab/pinchtab
Modified: 3/26/2026
—Go
GO-2026-4822· CVE-2026-33620, GHSA-mrqc-3276-74f8PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems in github.com/pinchtab/pinchtab
Modified: 3/26/2026
—Go
GO-2026-4823· CVE-2026-33623, GHSA-p8mm-644p-phmhPinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution in github.com/pinchtab/pinchtab
Modified: 3/26/2026
—Go
GO-2026-4824· CVE-2026-33622, GHSA-w5pc-m664-r62vA PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution in github.com/pinchtab/pinchtab
Modified: 3/26/2026
—Go
GO-2026-4825· CVE-2026-33619, GHSA-xqq2-4j46-vwp7PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl in github.com/pinchtab/pinchtab
Modified: 3/26/2026