llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: OSV:PYSEC-2026-4066...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: GHSA-3CV6-JPF6-8222...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: OSV:GHSA-3CV6-JPF6-8222...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: SNYK:PYTHON-LITELLM-19644158...

CVE-2026-22681

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-22681

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

EUVD-2026-63999

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-22681

OpenViking (by Volcengine) before 0.3.4 is vulnerable to Server-Side Request Forgery (SSRF) via the /api/v1/resources endpoint. An authenticated low-privilege attacker can POST a crafted URL, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, ...

CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-22681: Server-Side Request Forgery (SSRF)

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

PT-2026-79394

Name of the Vulnerable Software and Affected Versions OpenViking versions prior to 0.3.4 Description Authenticated low-privilege attackers can access internal network services by submitting arbitrary URLs to the resources API endpoint. By sending a POST request with a crafted URL to the...

CVE-2026-75480

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

CVE-2026-75480

OpenViking's debug vector scroll and count endpoints in viking_vector_index_backend.py use account-level scoping without per-user access controls, allowing any authenticated user to read private memories, resources, skills, and secret material belonging to co-tenants. CVSS 6.5; exploitation in th...

CVE-2026-75480 OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

CVE-2026-75480 OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

EUVD-2026-60392

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

CVE-2026-75480 OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

CVE-2026-75480: Incorrect Authorization

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...