What is CVE-2026-3965?
A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue.
The record classifies CVE-2026-3965 under weakness class CWE-693. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 207 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 6.3 — MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS v4.0 base score
- 2.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS (FIRST)
- 0.1% probability of exploitation in the next 30 days, higher than 27.6% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- 2026-03-12, last modified 2026-04-29
Is CVE-2026-3965 being exploited?
No public exploitation evidence for CVE-2026-3965 is recorded in the sources Threadlinqs tracks — CISA KEV, Exploit-DB, public proof-of-concept repositories and ProjectDiscovery Nuclei — as of 2026-04-29. That is an absence of evidence in those feeds, not a guarantee that the vulnerability is unexploited.
Affected products and versions
- Whyour: Qinglong
How to fix CVE-2026-3965
The record marks a vendor fix as available for CVE-2026-3965. Vendor advisory: https://github.com/whyour/qinglong/releases/tag/v2.20.2. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2026-3965
1 tracked threat in the Threadlinqs corpus references CVE-2026-3965, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Seeded from nvd and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.