rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-33249 NATS: Message tracing can be redirected to arbitrary subject
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: nats-io
product: nats-server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2026-03-25T20:21:30.156Z
CVE-2026-33250 Crash when receiving specially-crafted packets
Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: longturn
product: freeciv21
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-03-23T23:38:02.070Z
CVE-2026-33251 Discourse has a Hidden Solved topics permission bypass
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass vulnerability in hidden Solved topics may allow unauthorized users to accept or unaccept solutions. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure only trusted users are part of the Site Setting for accept_all_solutions_allowed_groups.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: discourse
product: discourse
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2026-03-20T22:52:37.051Z
CVE-2026-33252 MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: modelcontextprotocol
product: go-sdk
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
version: 3.1
Published: 2026-03-23T23:44:16.106Z
CVE-2026-33253 
SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
Problem types: cwe_id: CWE-428
description: Unquoted search path or element
Affected products: vendor: SANYO DENKI CO., LTD.
product: SANUPS SOFTWARE STANDALONE
vendor: SANYO DENKI CO., LTD.
product: SANUPS SOFTWARE
Published: 2026-03-25T05:11:53.688Z
CVE-2026-33254 Resource exhaustion via DoQ/DoH3 connections
An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.
Problem types: description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: PowerDNS
product: DNSdist
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Credits: lang: en
value: Salvor Labs - https://salvor.fr
Published: 2026-04-22T13:45:07.069Z
CVE-2026-33256 Unbounded memory allocation by internal web server
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Problem types: description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: PowerDNS
product: Recursor
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Credits: lang: en
value: Ap4sh - Samy Medjahed and Ethicxz - Eliott Laurie Ap4sh / Ethicxz
Published: 2026-04-22T09:37:32.538Z
CVE-2026-33257 Insufficient input validation of internal webserver
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Problem types: description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: PowerDNS
product: Authoritative
default_status: unaffected
vendor: PowerDNS
product: DNSdist
default_status: unaffected
vendor: PowerDNS
product: Recursor
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Credits: lang: en
value: Vitaly Simonovich
Published: 2026-04-22T09:37:59.871Z
CVE-2026-33258 Crafted zones can cause increased resource usage
By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.
Problem types: description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: PowerDNS
product: Recursor
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Credits: lang: en
value: Haruto Kimura (Stella)
Published: 2026-04-22T09:38:19.312Z
CVE-2026-33259 Concurrent modification of RPZ data can lead to denial of servce
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
Problem types: description: Use After Free
Affected products: vendor: PowerDNS
product: Recursor
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Credits: lang: en
value: Haruto Kimura (Stella)
Published: 2026-04-22T09:38:51.991Z
CVE-2026-33260 Insufficient input validation of internal webserver
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Problem types: description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: PowerDNS
product: Authoritative
default_status: unaffected
vendor: PowerDNS
product: DNSdist
default_status: unaffected
vendor: PowerDNS
product: Recursor
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Credits: lang: en
value: Cavid
Published: 2026-04-22T09:39:35.859Z
CVE-2026-33261 Null pointer accces in aggressive NSEC(3) cache
A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.
Problem types: description: Missing Support for Integrity Check
Affected products: vendor: PowerDNS
product: Recursor
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: ylwango613
Published: 2026-04-22T09:40:03.564Z
CVE-2026-33262 Insufficient validation of cookie reply
An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default.
Problem types: description: NULL Pointer Dereference
Affected products: vendor: PowerDNS
product: Recursor
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: ylwango613
Published: 2026-04-22T09:40:24.320Z
CVE-2026-33265 
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
Problem types: cwe_id: CWE-669
description: CWE-669 Incorrect Resource Transfer Between Spheres
Affected products: vendor: LibreChat
product: LibreChat
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2026-03-18T11:17:45.271Z
CVE-2026-33266 Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt
Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.

The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.


This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: Apache Software Foundation
product: Apache OpenMeetings
default_status: unaffected
Credits: lang: en
value: 4ra2n (A code security AI agent)
Published: 2026-04-09T15:52:36.105Z
CVE-2026-33268 Nanoleaf Lines unauthenticated firmware file store
Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources. Fixed in 12.3.6.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Nanoleaf
product: Lines
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 6.5
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
integrityImpact: LOW
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: NONE
confidentialityImpact: NONE
Credits: lang: en
value: Souvik Kandar
Published: 2026-03-25T14:21:30.534Z
CVE-2026-33271 
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 42902.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: Acronis
product: Acronis True Image
default_status: unaffected
Credits: lang: en
value: @s3nds3c (https://hackerone.com/s3nds3c)
Published: 2026-04-02T17:06:24.089Z
CVE-2026-33273 
Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be created by an administrator of the product. As a result, arbitrary code may be executed on the server.
Problem types: cwe_id: CWE-434
description: Unrestricted upload of file with dangerous type
Affected products: vendor: ICZ Corporation
product: MATCHA INVOICE
Published: 2026-04-08T05:11:03.549Z
CVE-2026-33276 XSS in Unified Search via Unescaped Host/Service Names
Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of other users performing searches in the Unified Search feature.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Checkmk GmbH
product: Checkmk
default_status: unaffected
Published: 2026-03-31T13:44:17.857Z
CVE-2026-33277 
An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may be executed by a logged-in user.
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)
product: LogonTracer
Published: 2026-04-27T00:03:41.704Z
CVE-2026-33278 Possible arbitrary code execution during DNSSEC validation
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
cwe_id: CWE-672
description: CWE-672: Operation on a Resource after Expiration or Release
Affected products: vendor: NLnet Labs
product: Unbound
default_status: unaffected
Credits: lang: en
value: Qifan Zhang (Palo Alto Networks)
Published: 2026-05-20T09:18:15.225Z
CVE-2026-33280 
Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands.
Problem types: cwe_id: CWE-912
description: Hidden functionality
Affected products: vendor: BUFFALO INC.
product: BUFFALO Wi-Fi router products
Published: 2026-03-27T05:25:41.078Z
CVE-2026-33281 Ella Core panics on invalid PDU Session IDs in NGAP messages
Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing NGAP messages with invalid PDU Session IDs outside of 1-15. An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.6.0 added PDU Session ID validations during NGAP message handling.
Problem types: cwe_id: CWE-129
description: CWE-129: Improper Validation of Array Index
Affected products: vendor: ellanetworks
product: core
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-03-23T23:46:12.797Z
CVE-2026-33282 Ella Core panics on malformed NGAP Location Report
Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing a malformed NGAP LocationReport message with  `ue-presence-in-area-of-interest` event type and omitting the optional `UEPresenceInAreaOfInterestList` IE. An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.6.0 added IE presence verification to NGAP message handling.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: ellanetworks
product: core
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-03-23T23:47:26.483Z
CVE-2026-33283 Ella Core panics on malformed ULNASTransport Message without a Request Type
Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing malformed UL NAS Transport NAS messages without a Request Type. An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.6.0 adds a guard when receiving an UL NAS Message without a Request Type given no SM Context.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: ellanetworks
product: core
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-03-23T23:49:42.539Z
CVE-2026-33284 GlobalLeaks has insufficient URL validation in user support API
GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches the issue.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: globaleaks
product: globaleaks-whistleblowing-software
Published: 2026-03-27T13:58:54.085Z
CVE-2026-33285 LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can be completely bypassed by using reverse range expressions (e.g., `(100000000..1)`), allowing an attacker to allocate unlimited memory. Combined with a string flattening operation (e.g., `replace` filter), this causes a V8 Fatal error that crashes the Node.js process, resulting in complete denial of service from a single HTTP request. Version 10.25.1 patches the issue.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: harttle
product: liquidjs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-03-26T00:34:25.169Z
CVE-2026-33286 Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations. Any application exposing Graphiti write endpoints (create/update/delete) to untrusted users is affected. The `Graphiti::Util::ValidationResponse#all_valid?` method recursively calls `model.send(name)` using relationship names taken directly from user-supplied JSONAPI payloads, without validating them against the resource's configured sideloads. This allows an attacker to potentially run any public method on a given model instance, on the instance class or associated instances or classes, including destructive operations. This is patched in Graphiti v1.10.2. Users should upgrade as soon as possible. Some workarounds are available. Ensure Graphiti write endpoints (create/update) are not accessible to untrusted users and/or apply strong authentication and authorization checks before any write operation is processed, for example use Rails strong parameters to ensure only valid parameters are processed.
Problem types: cwe_id: CWE-913
description: CWE-913: Improper Control of Dynamically-Managed Code Resources
Affected products: vendor: graphiti-api
product: graphiti
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2026-03-23T23:52:30.381Z