HIGHnpm
GHSA-r95q-fp26-h3hc· CVE-2026-55177CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard
Modified: 7/17/2026
package
npm/@tak-ps/cloudtak
pkg:npm/%40tak-ps/cloudtak
MEDIUM5.0npm
GHSA-vqrw-qphh-p34v· CVE-2026-54546TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
Modified: 9/17/2026