Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: cheshire-cat-ai Clear all filters
TI-2026-70704 CVE-2026-108725 · GHSA-37wv-8fg5-p97x

Stored cross-site scripting in Cheshire Cat AI core uploads plugin

Priority MEDIUM 56

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00264 Published 2026-10-11 No fix listed CWE-79
TI-2026-58452 CVE-2026-85093 · GHSA-cx5g-gfhq-8qmj

Cheshire Cat AI Memory Collection Endpoint Information Disclosure

Priority HIGH 70

Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-03 No fix listed CWE-863