CVE-2025-56526

CVE-2025-56526 concerns Kotaemon 0.11.0 and is described as a cross-site scripting (XSS) vulnerability. The issue allows an attacker to execute arbitrary code through a crafted PDF rendered by Kotaemon. The published descriptor includes a CVSS 3.1 base score of 6.1 (Medium) with network attack ve...

CVE-2025-63914

Cinnamon kotaemon 0.11.0 is affected by CVE-2025-63914 due to the _may_extract_zip function in lib/ktem/ktem/index/file/ui.py not validating uploaded ZIP contents. This can allow a ZIP bomb to exhaust resources during decompression; even though files are extracted to a temporary folder cleared af...

CVE-2025-56527

The CVE-2025-56527 entry concerns Kotaemon 0.11.0 where plaintext passwords are stored in the client’s localStorage. The associated CVSS 3.1 score is 7.5 (HIGH) with an attack vector of Network, attack complexity Low, no privileges required, no user interaction, and but with Confidentiality Impac...