Vendors / Cinnamon Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 1
Exploited now Cinnamon records in CISA KEV No Cinnamon vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 81
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON inp…
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00914 · Published 2026-08-04 · No fix listed CWE-502
Priority HIGH 74
Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py.
CVSS 4.0 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00433 · Published 2026-08-28 · No fix listed CWE-639
Priority HIGH 66
Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00456 · Published 2025-11-18 · No fix listed CWE-256
Priority MEDIUM 62
An issue was discovered in Cinnamon kotaemon 0.11.0.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00383 · Published 2025-11-24 · No fix listed CWE-409
Priority MEDIUM 60
Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00443 · Published 2025-11-18 · No fix listed CWE-79
Priority LOW 29
kotaemon is an open-source RAG-based tool for document comprehension.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00472 · Published 2025-07-02 · No fix listed CWE-22
Open these records in search → All records by CVSS severity
2 1 3 0 0
THREATIST.IORead the docs