Threat database

CVE-2026-42717 is a high-severity SQL Injection vulnerability affecting VaultDweller's Leyka product versions up to and including 3.32.3. The flaw allows an administrator-level user to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability has a CVSS score of 7.6, indicating a significant risk primarily to confidentiality and availability. No official patch or remediation details are provided, and no known exploits are reported in the wild.

CVE-2026-66677 is a high-severity authentication bypass vulnerability in VaultDweller's Leyka product affecting versions up to 3.32.3. It involves broken authentication that allows bypassing using an alternate path or channel. The vulnerability has a CVSS 3.1 score of 7.6, indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability. No patch or remediation information is provided.

Path Traversal: '.../...//' vulnerability in VaultDweller Leyka leyka allows PHP Local File Inclusion.This issue affects Leyka: from n/a through <= 3.32.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows DOM-Based XSS.This issue affects Leyka: from n/a through <= 3.32.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows Stored XSS.This issue affects Leyka: from n/a through <= 3.31.8.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in VaultDweller Leyka leyka.This issue affects Leyka: from n/a through <= 3.31.6.