Read the docs

decolua

Records26All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high13CVSS 7.0–8.9

Exploited now

decolua records in CISA KEV

No decolua vulnerabilities are listed in CISA KEV.

Records

26 records

TI-2026-44499 CVE-2026-62327 · GHSA-7gvh-h32g-9cfw

9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

Priority HIGH 81

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unaut…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.06272 Published 2026-07-13 No fix listed CWE-306
TI-2026-42622 CVE-2026-59801 · GHSA-7f4f-856q-69wc

9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

Priority HIGH 81

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing a…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.02619 Published 2026-07-13 No fix listed CWE-306
TI-2026-44500 CVE-2026-62328 · GHSA-xjwv-xjj9-gqqc

9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints

Priority HIGH 77

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0046 Published 2026-07-13 No fix listed CWE-359
TI-2026-40052 CVE-2026-55500 · GHSA-qvfm-67h2-2qfx

Information disclosure in decolua 9router

Priority HIGH 76

9Router is an AI router & token saver.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0048 Published 2026-07-10 Fixed in 0.4.80 CWE-200
TI-2026-42621 CVE-2026-59800 · GHSA-g6g7-pvmx-m74p

9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint

Priority HIGH 75

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.02075 Published 2026-07-07 Fixed in 0.4.44 CWE-78
TI-2026-51084 CVE-2026-72860 · GHSA-cqgh-7h49-q3mr

Server-side request forgery in decolua 9router

Priority MEDIUM 61

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00384 Published 2026-08-20 No fix listed CWE-184
TI-2026-45319 CVE-2026-63732 · GHSA-qvg7-rqwf-6wmh

9router before 0.4.60 Remote Code Execution via default password

Priority MEDIUM 44

9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, an…

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.01011 Published 2026-07-23 Fixed in 0.4.60 CWE-78
TI-2026-70577 CVE-2026-108593 · GHSA-chcq-pfxc-99ww

Configuration injection in 9router lets attackers run shell commands

Priority LOW 34

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent c…

CVSS 4.0HIGH 7.3 Network High privileges User interaction EPSS 0.00268 Published 2026-10-10 No fix listed CWE-94
Load more
Open these records in search →