Vulnerabilities

TI-2025-39488 CVE-2025-63914 · GHSA-j3h2-559w-j4x9

An issue was discovered in Cinnamon kotaemon 0.11.0.

MEDIUM 62

An issue was discovered in Cinnamon kotaemon 0.11.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00383 Published 2025-11-24 No fix listed CWE-409

TI-2025-35363 CVE-2025-56527 · GHSA-p7mm-hwh2-5wx4

HIGH 66

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00456 Published 2025-11-18 No fix listed CWE-256

TI-2025-35362 CVE-2025-56526 · GHSA-vfwg-j93f-wfr4

MEDIUM 60

Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2025-11-18 No fix listed CWE-79