Log in Start free

Comfy-Org

Products

ProductCVEsExploitedLatest
ComfyUI6–Sep 16, 2026
ComfyUI-Manager1–Jan 10, 2026

Exploited and recent CVEs

  • CVE-2026-92816 High 7.8 ComfyUI before 0.30.0 Path Traversal via dataset save nodes 0.2%
  • CVE-2026-68771 Critical 9.8 ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization 1.1%
  • CVE-2026-56673 High 7.5 ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration 0.6%
  • CVE-2026-56672 High 8.2 ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization 0.4%
  • CVE-2026-56671 High 7.5 ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read 1.0%
  • CVE-2026-56670 High 8.2 ComfyUI: Stored XSS via SVG file upload on the /view endpoint 0.4%
  • CVE-2026-22777 High 7.5 ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler 0.9%