CVE-2025-67303

ComfyUI-Manager versions prior to 3.38 are vulnerable to an Unprotected Alternate Channel (CWE-420) . The application stored configuration files in the user/default/ComfyUI-Manager/ directory, which was accessible via ComfyUI web APIs without proper access control. Remote attackers with web acces...

CVE-2026-22777

CVE-2026-22777 concerns ComfyUI-Manager, an extension for ComfyUI. A CRLF injection vulnerability exists in the configuration handling where an attacker can inject special characters into HTTP query parameters to add arbitrary values to the config.ini, potentially tampering with security settings...