{"items":[{"id":"CVE-2026-55485","published":"2026-08-28T18:13:23.605Z","updated":"2026-08-31T18:52:38.329Z","title":"Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.","severity":"HIGH","score":8.8,"vendor":"piccolo-orm","product":"piccolo_admin","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2024-30248","published":"2024-04-02T14:55:17.483Z","updated":"2024-08-02T01:32:05.414Z","title":"Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page","severity":"HIGH","score":7.7,"vendor":"piccolo-orm","product":"piccolo_admin","kev":false,"epss":0.00493,"kevAdded":null},{"id":"CVE-2023-47128","published":"2023-11-10T18:11:07.863Z","updated":"2024-09-03T17:28:09.878Z","title":"piccolo SQL Injection via named transaction savepoints","severity":"CRITICAL","score":9.1,"vendor":"piccolo-orm","product":"piccolo","kev":false,"epss":0.00776,"kevAdded":null},{"id":"CVE-2023-41885","published":"2023-09-12T20:03:27.585Z","updated":"2024-09-26T13:36:08.365Z","title":"Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration","severity":"MEDIUM","score":5.3,"vendor":"piccolo-orm","product":"piccolo","kev":false,"epss":0.00556,"kevAdded":null}]}