EUVD-2026-91837

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

EUVD-2026-91835

The Playground feature of Zilliz Attu before 3.0.0 allows SSRF proxying of requests to private IP addresses...

CVE-2026-105048

The Playground feature of Zilliz Attu before 3.0.0 allows SSRF proxying of requests to private IP addresses...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu versions prior to 3.0.0 are vulnerable to a missing authentication flaw in the Playground feature. This vulnerability allows unauthenticated attackers to proxy arbitrary HTTP and HTTPS requests to URLs on the public internet. No specific exploit details or remediation steps are provid...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105048

The Playground feature of Zilliz Attu before 3.0.0 allows SSRF proxying of requests to private IP addresses...

CVE-2026-105048

The Playground feature of Zilliz Attu before 3.0.0 allows SSRF proxying of requests to private IP addresses...

CVE-2026-105048

The Playground feature in Zilliz Attu versions prior to 3.0.0 is vulnerable to Server-Side Request Forgery (SSRF) . This flaw allows an attacker to proxy requests to private IP addresses . No specific remediation or exploit details are provided in the documents.

CVE-2026-105048

The Playground feature of Zilliz Attu before 3.0.0 allows SSRF proxying of requests to private IP addresses...

PT-2026-104452

Name of the Vulnerable Software and Affected Versions Zilliz Attu versions prior to 3.0.0 Description The Playground feature allows the proxying of arbitrary HTTP and HTTPS requests to URLs on the public internet without requiring authentication. This leads to a Server-Side Request Forgery SSRF, ...

PT-2026-104451

Name of the Vulnerable Software and Affected Versions Zilliz Attu versions prior to 3.0.0 Description The Playground feature allows Server-Side Request Forgery SSRF, a condition where the server can be coerced into making requests to private IP addresses, effectively acting as a proxy...

CVE-2026-105049: Missing Authentication for Critical Function

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105048: Improper Validation of Unsafe Equivalence in Input

The Playground feature of Zilliz Attu before 3.0.0 allows SSRF proxying of requests to private IP addresses...

Deep-searcher access control error vulnerability

Deep-Searcher is a private data search and intelligent question-answering tool developed by Zilliz, based on large models and VectorDB. Versions of Deep-Searcher 0.0.2 and earlier contain an access control vulnerability. This vulnerability stems from the operation of the CollectionRouter.invoke...

EUVD-2026-34272

A vulnerability was detected in zilliztech GPTCache up to 0.1.44. Affected by this issue is the function BufferedReader.peek of the file gptcache/processor/pre.py of the component Cache Key Handler. Performing a manipulation of the argument inputdata"image" results in use of weak hash. The attack...