Login Request a demo
ON
Product
Onyx
by onyx-dot-app · last CVE Oct 25, 2026
7
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 1High 1Medium 4Low 1
Severity
All severities7Critical1High1Medium4Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Onyx to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-7894
9.8
1%
Jul 20
A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1
Affected: through 0.29.1
CVE-2024-7767
8.1
1%
Mar 20
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94
Affected: 0.3.94
CVE-2026-42277
6.5
0%
May 8
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
Affected: before 3.0.9; 3.1.0 before 3.1.6; 3.2.0 before 3.2.6
CVE-2024-9612
6.5
1%
Mar 20
In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page
Affected: 0.3.94
CVE-2025-51479
5.4
0%
Jul 22
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH…
Affected: 0.27.0
CVE-2026-42276
4.3
0%
May 8
Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
Affected: before 3.0.9; 3.1.0 before 3.1.6; 3.2.0 before 3.2.6
CVE-2026-116004
New
3.5
0%
Oct 25
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
Affected: 5.0
Showing 7