Priority LOW 25
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.005 · Published 2026-09-05 · Fixed in 0.8.14 CWE-441
Priority MEDIUM 61
A vulnerability was found in SimStudioAI sim up to 0.6.92.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0031 · Published 2026-06-28 · No fix listed CWE-327
Priority MEDIUM 48
On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-03-02 · Fixed in 0.5.74 CWE-862
Priority MEDIUM 49
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00401 · Published 2026-03-02 · Fixed in 0.5.74 CWE-862
Priority HIGH 70
A vulnerability was identified in simstudioai sim up to 0.5.27.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00788 · Published 2025-12-26 · No fix listed CWE-287
Priority MEDIUM 57
A vulnerability was identified in SimStudioAI sim up to 1.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.0078 · Published 2025-09-08 · No fix listed CWE-74
Priority MEDIUM 57
A vulnerability was determined in SimStudioAI sim up to 1.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00284 · Published 2025-09-08 · No fix listed CWE-918
Priority MEDIUM 57
A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00302 · Published 2025-09-02 · No fix listed CWE-918
Priority MEDIUM 57
A security vulnerability has been detected in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00763 · Published 2025-09-01 · No fix listed CWE-22
Priority MEDIUM 57
A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00329 · Published 2025-09-01 · No fix listed CWE-284
Priority HIGH 70
A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00586 · Published 2025-07-07 · No fix listed CWE-287
Priority HIGH 70
A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00923 · Published 2025-07-07 · No fix listed CWE-22
THREATIST.IORead the docs