Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: pipeshub-ai Clear all filters
TI-2026-83187 CVE-2026-119712 · GHSA-5r5q-7f5q-f5h2

Server-side request forgery in PipesHub via image URLs in documents

Priority MEDIUM 57

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in document…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00253 Published 2026-10-30 Fixed in 0.10.0 CWE-918
TI-2026-83186 CVE-2026-119711 · GHSA-v4v4-55gm-p3cp

Rate limit bypass in PipesHub via spoofed X-Forwarded-For header

Priority HIGH 70

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0022 Published 2026-10-30 Fixed in 0.10.0 CWE-348
TI-2026-83185 CVE-2026-119710 · GHSA-82c7-jq78-hwgw

Event type injection in PipesHub lets users delete connectors

Priority MEDIUM 64

PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00424 Published 2026-10-30 Fixed in 0.10.0 CWE-862