joro vulnerabilities

1 known vulnerability in joro from BishopFox. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.6 Critical severity

  joro: Missing Authentication for Critical Functionality

  CVE-2026-53649Sep 2, 2026BishopFox

  Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data