ON
Vendor
onyx-dot-app
7
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116004 New | ON Onyx onyx-dot-app | 3.5 | Oct 25 | onyx-dot-app Onyx PreviewTab.tsx cross site scripting |
| CVE-2026-42277 | ON Onyx Onyx | 6.5 | May 8 | Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files |
| CVE-2026-42276 | ON Onyx Onyx | 4.3 | May 8 | Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions |
| CVE-2025-51479 | ON Onyx Onyx | 5.4 | Jul 22 | Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH… |
| CVE-2025-7894 | ON Onyx Onyx | 9.8 | Jul 20 | A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1 |
| CVE-2024-9612 | ON Onyx Onyx | 6.5 | Mar 20 | In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page |
| CVE-2024-7767 | ON Onyx Onyx | 8.1 | Mar 20 | An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94 |