Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: UnicomAI Wanwu 0.6.3 Clear all filters
TI-2026-70744 CVE-2026-108854 · GHSA-975v-7377-g4qf

Insecure direct object reference in UnicomAI Wanwu lets users delete AppKeys

Priority LOW 23

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00227 Published 2026-10-11 Fixed in 0.6.3 CWE-639
TI-2026-70743 CVE-2026-108853 · GHSA-fg7x-9rxv-3m3p

UnicomAI Wanwu IDOR lets users delete other tenants' apps

Priority HIGH 65

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00366 Published 2026-10-11 Fixed in 0.6.3 CWE-639