PatchSiren

CoreBunch CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM CoreBunch CVE published 2026-08-10

CVE-2026-72587

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint. This vulnerability has a CVSS score of 6.1, indicating medium severity. Organizations should review and assess the vulnerability's impact on their asset [truncated]