CyberSecBulletin

Vas3k vulnerabilities

We track 2 vulnerabilities in Vas3k products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 20, 2026.

2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score

Latest Vas3k vulnerabilities

  • 7.3 High severity

    TaxHacker: Server-Side Request Forgery

    CVE-2026-94039Vas3k

    A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side

  • 7.3 High severity

    TaxHacker: Use of Hard-coded Password

    CVE-2026-78062Vas3k

    A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentia