onyx-dot-app vulnerabilities
6 published CVEs name onyx-dot-app among the affected products.
- 6Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 1Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-116004
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
onyx-dot-app · Onyx
Medium5.1 - CVE-2026-85700
Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints
onyx-dot-app · onyx
High7.1 - CVE-2026-63178
Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure
onyx-dot-app · onyx
Medium6.5 - CVE-2026-71424
Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers
onyx-dot-app · onyx
Critical9.6 - CVE-2026-42277
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
onyx-dot-app · onyx
Medium6.5 - CVE-2026-42276
Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
onyx-dot-app · onyx
Medium4.3