Login Request a demo
ON
Product
onyx
by onyx-dot-app · last CVE Sep 4, 2026
5
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 1High 0Medium 4Low 0
Severity
All severities5Critical1High0Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add onyx to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-71424
9.6
0%
Aug 17
Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers
Affected: < 3.1.10; >= 3.2.0, < 3.2.14; >= 3.3.0-beta.0, < 4.0.0
CVE-2026-85700
6.5
1%
Sep 4
Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints
Affected: through 4.6.6
CVE-2026-63178
6.5
1%
Aug 17
Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure
Affected: < 4.3.0
CVE-2026-42277
6.5
0%
May 8
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
Affected: < 3.0.9; >= 3.1.0, < 3.1.6; >= 3.2.0, < 3.2.6
CVE-2026-42276
4.3
0%
May 8
Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
Affected: < 3.0.9; >= 3.1.0, < 3.1.6; >= 3.2.0, < 3.2.6
Showing 5