onlook

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

onlook records in CISA KEV

No onlook vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Onlook 3 records HIGH

Records

3 records in Onlook · all components

TI-2025-39457 CVE-2025-63783 · GHSA-662x-h9f2-q6cg

A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC…

HIGH 66

A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00312 Published 2025-11-07 No fix listed CWE-20

TI-2025-39458 CVE-2025-63784 · GHSA-r4cg-5xmx-26h7

An Open Redirect vulnerability exists in the OAuth callback handler in file…

MEDIUM 62

An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00447 Published 2025-11-07 No fix listed CWE-601

TI-2025-39459 CVE-2025-63785 · GHSA-f2mq-8pqx-fqh5

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of…

MEDIUM 60

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00285 Published 2025-11-07 No fix listed CWE-116

Open these records in search →

Critical	0
High	2
Medium	2
Low	0
No CVSS	0