Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Helicone Clear all filters
TI-2026-70585 CVE-2026-108602 · GHSA-ch5j-5g34-4wwh

Server-side request forgery in Helicone Jawn webhook sender

Priority LOW 23

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to priva…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00213 Published 2026-10-10 No fix listed CWE-918
TI-2026-58511 CVE-2026-85178 · GHSA-2f4g-hjp3-9wf4

Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter

Priority HIGH 69

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-03 Fixed CWE-639