Vendors / wandb Records 7 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 1
Exploited now wandb records in CISA KEV No wandb vulnerabilities are listed in CISA KEV.
Priority MEDIUM 60
wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads from an AWS S3 bucket.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00291 · Published 2025-02-10 · No fix listed CWE-306
Priority MEDIUM 58
A stored Cross-site Scripting (XSS) vulnerability exists in the latest version of wandb/openui.
CVSS 3.0 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00309 · Published 2025-03-20 · No fix listed CWE-79
Priority MEDIUM 57
A flaw has been found in wandb OpenUI up to 1.0.
CVSS 4.0 MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00343 · Published 2026-03-27 · No fix listed CWE-79
Priority MEDIUM 56
A vulnerability was determined in wandb OpenUI up to 1.0.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00198 · Published 2026-03-28 · No fix listed CWE-79
Priority MEDIUM 56
A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb.
CVSS 4.0 MEDIUM 5.1· Adjacent network · Low privileges · No interaction · EPSS 0.00208 · Published 2026-03-28 · No fix listed CWE-200
Priority MEDIUM 55
A vulnerability has been found in wandb OpenUI up to 0.0.0.0/1.0.
CVSS 4.0 MEDIUM 4.8· Local · Low privileges · No interaction · EPSS 0.00146 · Published 2026-03-28 · No fix listed CWE-259
Priority MEDIUM 42
Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks.
CVSS 4.0 HIGH 8.7· Network · No auth · User interaction · EPSS 0.01167 · Published 2026-09-15 · Partial fix · 0.29.0 CWE-22
Open these records in search → All records by CVSS severity
0 1 6 0 0
THREATIST.IORead the docs