Advisories · Technology

Cleanuparr.

Every CVE that names Cleanuparr among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-44184 CVE record

CVSS 8.0 High

Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads
- Cleanuparr
- CWE-346
- CWE-942
Not analysed yet 12 May 2026
CVE-2026-44183 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Cleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabled
- Cleanuparr
- Authentication bypass
- CWE-348
Not analysed yet 12 May 2026
CVE-2026-32702 CVE record

CVSS 6.9 Medium

Cleanuparr has Username Enumeration via Timing Attack
- Cleanuparr
- CWE-208
Not analysed yet 13 Mar 2026