Advisories · Technology
Onyx.
Every CVE that names Onyx among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
- Onyx
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.1 High
Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints
- onyx
- Hard-coded credentials
- CVSS 6.5 Medium
Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure
- onyx
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers
- onyx
- Information disclosure
- Broken access control
- CVSS 6.5 Medium
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
- onyx
- Broken access control
- CVSS 4.3 Medium
Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
- onyx
- Broken access control
- CVSS 5.3 Medium
Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection
- Onyx
- Other injection
- SQL injection