{"items":[{"id":"CVE-2026-42552","published":"2026-05-13T19:24:15.132Z","updated":"2026-05-15T18:49:21.316Z","title":"Flight: Sensitive information disclosure via default error handler in flightphp/core","severity":"HIGH","score":7.5,"vendor":"flightphp","product":"core","kev":false,"epss":0.00335,"kevAdded":null,"exploit":true},{"id":"CVE-2026-42551","published":"2026-05-13T19:23:27.314Z","updated":"2026-05-14T12:49:48.236Z","title":"Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core","severity":"HIGH","score":7.5,"vendor":"flightphp","product":"core","kev":false,"epss":0.00351,"kevAdded":null,"exploit":true},{"id":"CVE-2026-42550","published":"2026-05-13T19:22:53.297Z","updated":"2026-05-14T15:44:19.900Z","title":"Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete","severity":"HIGH","score":8.8,"vendor":"flightphp","product":"core","kev":false,"epss":0.00455,"kevAdded":null,"exploit":true},{"id":"CVE-2026-42549","published":"2026-05-13T19:22:20.932Z","updated":"2026-05-14T19:52:29.945Z","title":"Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root","severity":"MEDIUM","score":4.4,"vendor":"flightphp","product":"core","kev":false,"epss":0.00204,"kevAdded":null,"exploit":true},{"id":"CVE-2026-42548","published":"2026-05-13T19:21:44.125Z","updated":"2026-05-14T12:32:32.147Z","title":"Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()","severity":"HIGH","score":8.6,"vendor":"flightphp","product":"core","kev":false,"epss":0.00449,"kevAdded":null,"exploit":true},{"id":"CVE-2014-125127","published":"2025-09-03T08:35:05.988Z","updated":"2025-09-03T13:20:06.873Z","title":"Denial of Service (DoS) vulnerability in mikecao/flight","severity":"HIGH","score":7.5,"vendor":"flightphp","product":"core","kev":false,"epss":0.0047,"kevAdded":null,"exploit":true}]}