DR
Vendor
dragonflyoss
14
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-49254 | DR dragonfly dragonflyoss | 2.9 | Sep 15 | Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth |
| CVE-2026-54637 | DR dragonfly dragonflyoss | 5.5 | Sep 15 | Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile |
| CVE-2026-24124 | DR dragonfly dragonflyoss | 9.8 | Jan 22 | Dragonfly Manager Job API Allows Unauthenticated Access |
| CVE-2025-59410 | DR dragonfly dragonflyoss | 3.7 | Sep 17 | Dragonfly tiny file download uses hard coded HTTP protocol |
| CVE-2025-59354 | DR dragonfly dragonflyoss | 5.3 | Sep 17 | Dragonfly has weak integrity checks for downloaded files |
| CVE-2025-59353 | DR dragonfly dragonflyoss | 7.5 | Sep 17 | Manager generates mTLS certificates for arbitrary IP addresses |
| CVE-2025-59352 | DR dragonfly dragonflyoss | 9.8 | Sep 17 | Dragonfly allows arbitrary file read and write on a peer machine |
| CVE-2025-59351 | DR dragonfly dragonflyoss | 5.3 | Sep 17 | Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error |
| CVE-2025-59350 | DR dragonfly dragonflyoss | 5.3 | Sep 17 | Timing attacks against Proxy’s basic authentication are possible |
| CVE-2025-59349 | DR dragonfly dragonflyoss | 3.3 | Sep 17 | Directories created via os.MkdirAll are not checked for permissions |
| CVE-2025-59348 | DR dragonfly dragonflyoss | 7.5 | Sep 17 | Dragonfly incorrectly handles a task structure’s usedTraffic field |
| CVE-2025-59347 | DR dragonfly dragonflyoss | 6.5 | Sep 17 | Dragonfly Manager makes requests to external endpoints with disabled TLS authentication |
| CVE-2025-59346 | DR dragonfly dragonflyoss | 5.3 | Sep 17 | Dragonfly server-side request forgery vulnerability |
| CVE-2025-59345 | DR dragonfly dragonflyoss | 9.1 | Sep 17 | Dragonfly did not enable authentication for some Manager’s endpoints |