CVE-2026-36453
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.
- Published Sep 13, 2026
- CVSS 7.4 high
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available