The CVE-2026-115400 vulnerability in crawlseo before version 0.2.5 allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted. This issue is classified as a cleartext storage vulnerability. The vulnerability enables attackers to read plaintext long-lived refresh tokens from a compromised or exposed Postgres database, potentially leading to indefinite, un [truncated]
The CVE-2026-115411 vulnerability in crawlseo before version 0.2.4 allows an authenticated attacker to conduct internal network reconnaissance and potentially retrieve sensitive information from internal services and cloud metadata endpoints. The vulnerability is caused by the isPrivateIp() function failing to block reserved IP ranges, such as RFC 6598 Carrier-Grade NAT, RFC 6890, and TEST-NET ranges, as [truncated]
