Volcengine - vulnerabilities (CVEs)

8 CVEs in 1 products, 0 in the last 30 days, newest from 2026-08-21.

Products

• Openviking - 8 CVEs

Newest CVEs of Volcengine

• CVE-2026-22681 - CVSS 8.5 (high), 2026-08-21: OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network…
• CVE-2026-75480 - CVSS 7.1 (high), 2026-08-17: OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read…
• CVE-2026-13507 - CVSS 5 (medium), 2026-06-28: A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file…
• CVE-2026-40525 - CVSS 9.1 (critical), 2026-04-17: OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check…
• CVE-2026-22680 - CVSS 6.9 (medium), 2026-04-07: OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate…
• CVE-2026-34999 - CVSS 6.9 (medium), 2026-04-01: OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers…
• CVE-2026-28518 - CVSS 8.4 (high), 2026-03-03: OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to…
• CVE-2026-22207 - CVSS 9.8 (critical), 2026-02-26: OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT…