CVE-2026-75554Proof of concept (PoC) published · CISA
Explicit organization scopes survive token refresh after membership ends
CVSS score
2.3
EPSS probability
%0.4
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
5.9
CVE-2026-96596
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
E
Patch verified
8.3
CVE-2026-75542
OAuth token exchange grants repository scopes for organizations the principal cannot access
H
Patch verifiedEPSS %0
7.5
CVE-2026-96612
Path traversal in Hex via unvalidated dependency app names
H
Patch verifiedEPSS %0
6.9
CVE-2026-23939
Path Traversal in Local File Store Backend
H
Patch verifiedEPSS %0
7.1
CVE-2026-105668
Hex release-age cooldown is lifted package-wide when the locked release is retired
H
Patch verifiedEPSS %0
5.9
CVE-2026-103502
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
H
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-75554"