ON
Vendor
onyx-dot-app
5
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85700 | ON onyx onyx-dot-app | 6.5 | Sep 4 | Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints |
| CVE-2026-63178 | ON onyx onyx-dot-app | 6.5 | Aug 17 | Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure |
| CVE-2026-71424 | ON onyx onyx-dot-app | 9.6 | Aug 17 | Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers |
| CVE-2026-42277 | ON onyx onyx-dot-app | 6.5 | May 8 | Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files |
| CVE-2026-42276 | ON onyx onyx-dot-app | 4.3 | May 8 | Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions |