Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: wandb Clear all filters
TI-2026-61982 CVE-2026-91771 · GHSA-h5x7-chgg-fqcc

Weights & Biases wandb before 0.29.0 Path Traversal via File Download

Priority MEDIUM 42

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.01167 Published 2026-09-15 Partial fix · 0.29.0 CWE-22
TI-2026-04353 CVE-2026-4993 · GHSA-vf7r-qhhp-78wc

wandb OpenUI config.py hard-coded credentials

Priority MEDIUM 55

A vulnerability has been found in wandb OpenUI up to 0.0.0.0/1.0.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00146 Published 2026-03-28 No fix listed CWE-259
TI-2025-00151 CVE-2025-0192 · GHSA-9mhf-9hxp-8j3m

Stored Cross-site Scripting (XSS) in wandb/openui

Priority MEDIUM 58

A stored Cross-site Scripting (XSS) vulnerability exists in the latest version of wandb/openui.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00309 Published 2025-03-20 No fix listed CWE-79
TI-2024-09867 CVE-2024-10649 · GHSA-qw22-v3jj-h7x3

Unauthenticated File Upload in wandb/openui

Priority MEDIUM 60

wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads from an AWS S3 bucket.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00291 Published 2025-02-10 No fix listed CWE-306