Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: f Clear all filters
TI-2026-18200 CVE-2026-22665 · GHSA-pcq9-m482-5r7j

prompts.chat Identity Confusion via Case-Sensitive Username Handling

Priority LOW 39

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create c…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00338 Published 2026-04-03 Fixed CWE-178
TI-2026-18199 CVE-2026-22664 · GHSA-43rw-xw76-9g92

prompts.chat SSRF via Fal.ai Media Status Polling

Priority MEDIUM 64

prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status polling feature that allows authenticated users to perform arbitrary outbound requests by supplying att…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00313 Published 2026-04-03 Fixed CWE-918
TI-2026-18198 CVE-2026-22663 · GHSA-hphm-9vp4-h223

prompts.chat Authorization Bypass Information Disclosure

Priority MEDIUM 43

prompts.chat prior to commit 7b81836 contains multiple authorization bypass vulnerabilities due to missing isPrivate checks across API endpoints and page metadata generation that allow unauthorized users to access sensit…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00284 Published 2026-04-03 Fixed CWE-862
TI-2026-18197 CVE-2026-22662 · GHSA-gv6r-fmg6-c7v4

prompts.chat Blind SSRF via media-generate

Priority LOW 23

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00203 Published 2026-04-03 Fixed CWE-918
TI-2026-18196 CVE-2026-22661 · GHSA-3pwg-7q4v-jff5

prompts.chat Path Traversal via Skill File Handling

Priority HIGH 70

prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability in skill file handling that allows attackers to write arbitrary files to the client system by crafting malicious ZIP archives with unsanitized…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00369 Published 2026-04-03 Fixed CWE-22