{"id":"CVE-2026-36453","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-36453","summary":"Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.","details":"Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.","published":"2026-09-13T21:16:59.947","modified":"2026-09-13T21:16:59.947","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/rhymix/rhymix/commit/f131a616eb990e2b070a8381c3106ae979d40989","label":"rhymix/rhymix@f131a61"},"references":[{"type":"WEB","url":"https://github.com/rhymix/rhymix/commit/f131a616eb990e2b070a8381c3106ae979d40989"},{"type":"WEB","url":"https://rhymix.org/community/1932364"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-13T21:16:59.947"}}