Advisories · Technology
vanna.
Every CVE that names vanna among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
Vanna 2.0.2 Path Traversal via FileSystemConversationStore
- vanna
- Path traversal
- CVSS 6.9 Medium
vanna-ai vanna Legacy Flask API improper authorization
- vanna
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
vanna-ai vanna FastAPI/Flask Server cross-domain policy
- vanna
- CWE-346
- CWE-942
- CVSS 6.9 Medium
vanna-ai vanna Chat API Endpoint v2 missing authentication
- vanna
- Authentication bypass
- CVSS 5.3 Medium
vanna-ai vanna base.py ask sql injection
- vanna
- Other injection
- SQL injection
- CVSS 5.3 Medium
vanna-ai vanna legacy exec injection
- vanna
- Other injection
- CWE-707
- CVSS 6.9 Medium
vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery
- vanna
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
vanna-ai vanna Endpoint __init__.py update_sql sql injection
- vanna
- Other injection
- SQL injection