Comfy-Org ComfyUI

• CVE-2026-92816 High 7.8 ComfyUI before 0.30.0 Path Traversal via dataset save nodes 0.2%
• CVE-2026-68771 Critical 9.8 ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization 1.1%
• CVE-2026-56673 High 7.5 ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration 0.6%
• CVE-2026-56672 High 8.2 ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization 0.4%
• CVE-2026-56671 High 7.5 ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read 1.0%
• CVE-2026-56670 High 8.2 ComfyUI: Stored XSS via SVG file upload on the /view endpoint 0.4%