TI-2026-67533 CVE-2026-105145 · GHSA-8456-r8c8-j656
Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure
Priority HIGH 70
A vulnerability has been found in Weaviate Verba up to 2.1.3.
Vulnerabilities
7 records
TI-2026-46524 CVE-2026-65318 · GHSA-245v-963x-ff5c
Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader
Priority HIGH 79
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attac…
TI-2026-46523 CVE-2026-65317 · GHSA-vmf4-4c4w-vgqh
Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass
Priority HIGH 79
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP…
TI-2026-42273 CVE-2026-59093 · GHSA-667j-56pf-pq9c
Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment
Priority MEDIUM 41
Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role.
TI-2025-41468 CVE-2025-67819 · GHSA-hmmh-292h-3364
An issue was discovered in Weaviate OSS before 1.33.4.
Priority LOW 23
An issue was discovered in Weaviate OSS before 1.33.4.
TI-2025-41467 CVE-2025-67818 · GHSA-7v39-2hx7-7c43
An issue was discovered in Weaviate OSS before 1.33.4.
Priority LOW 35
An issue was discovered in Weaviate OSS before 1.33.4.
TI-2023-20227 CVE-2023-38976 · GHSA-8697-479h-5mfp
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via…
Priority HIGH 72
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.