CVE-2026-16209

highCVSS 7.3covered by 1 sourcefirst seen 2026-07-19

A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Applying a patch is advised to resolve this issue.

⚡ Watch CVE-2026-16209

Get an email if CVE-2026-16209 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-16209: A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown func…nvd · 2026-07-19

External references

NVD record for CVE-2026-16209

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-16209 status](https://www.csirts.com/badge/CVE-2026-16209)](https://www.csirts.com/cve/CVE-2026-16209)