CVE-2026-3965

CVE Enrichment

CVSS: 2.1 LOW
EPSS: 0.46%
EPSS Percentile: 39.81%
CISA KEV: Not listed

Description

A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue. The identifier of the patch is 6bec52dca158481258315ba0fc2f11206df7b719. It is advisable to upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 12-Mar-2026 07:16
Last Modified: 17-Jun-2026 17:44
EPSS Date: 2026-11-03
CWE: CWE-693

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:L /
                            UI:N /
                            VC:L /
                            VI:L /
                            VA:L /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:P /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

whyour · qinglong Source: CNA · [email protected]
Default status: unknown

2.20.0 — affected
2.20.1 — affected
2.20.2 — unaffected

Modules: API Interface

References

Last enrichment sync: 04-Nov-2026 19:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

The flaws, tracked as CVE-2026-3965 and CVE-2026-4047, allow unauthenticated remote code execution by exploiting discrepancies in how the system handles URL rewriting and case-sensitive path matching. SecurityWeek Roundup Covers Scattered Spider Arrest, ADT Data Leak and Security Advisories
The issues (CVE-2026-3965 and CVE-2026-4047) stem from a mismatch between middleware authorization and Express.js routing and were effectively fixed in PR #2941 after an initial insufficient mitigation; Hackers Exploit Qinglong Authentication Bypasses to Deploy Cryptominers

CVE (2)

Threat Actors (5)

MITRE ATT&CK (5)

Vendors (4)

Products (6)

Industries (3)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.