CVE-2025-61163

A flaw was found in Cohere North AI. The server fails to properly validate the Origin header of incoming connection requests, leading to an excessively permissive cross-domain policy with untrusted domains. This vulnerability could allow an attacker to gain unauthorized access to sensitive...

CVE-2025-61164

A flaw was found in Cohere North AI. This vulnerability allows for an information leak through its WebSocket Endpoint. A remote attacker could exploit this to gain unauthorized access to sensitive data. Mitigation Disable the affected WebSocket endpoint in the service configuration, or restrict...

CVE-2025-61162

A flaw was found in Cohere North AI. This incorrect access control vulnerability allows a remote attacker to send a specially crafted request to a specific API endpoint. This action enables the attacker to arbitrarily overwrite user information. The primary impact is unauthorized modification of...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

CVE-2025-61165

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2025-61165

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2025-61162

Cohere North AI v1.1.5 is affected by an incorrect access control vulnerability. A remote attacker can send a specially crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint to arbitrarily overwrite user information , leading to unauthorized modification of user data. To mitigate thi...

CVE-2025-61163

The Cohere North AI v1.1.5 software is susceptible to an excessively permissive cross-domain policy because the server fails to properly validate the Origin header of incoming connection requests. This flaw allows untrusted domains to bypass security restrictions, potentially enabling an attacker...

CVE-2025-61165

An arbitrary file upload vulnerability exists in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 . This flaw allows an attacker to execute arbitrary code by uploading a crafted file. The vulnerability has a CRITICAL severity score of 9.8, with high impacts on confidentiality, in...

CVE-2025-61164

A flaw in Cohere North AI v1.1.5 allows for an information leak through its WebSocket Endpoint . A remote attacker could exploit this vulnerability to gain unauthorized access to sensitive data. To mitigate this risk, users should disable the affected WebSocket endpoint in the service configurati...

EUVD-2025-210784

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

EUVD-2025-210786

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

EUVD-2025-210785

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

EUVD-2025-210787

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

PT-2026-82237

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...