Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: Cinnamon Clear all filters
TI-2026-56746 CVE-2026-82281 · GHSA-4qgc-qr9j-76rw

Kotaemon Missing Ownership Check in Conversation Functions

Priority HIGH 74

Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00433 Published 2026-08-28 No fix listed CWE-639
TI-2026-48505 CVE-2026-69098 · GHSA-5cg2-9v3x-66cv

kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

Priority HIGH 81

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON inp…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00914 Published 2026-08-04 No fix listed CWE-502