SSillyTavern

Products

Exploited and recent CVEs

• CVE-2026-108545 Medium 5.9 SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing 0.6%
• CVE-2026-44651 Medium 6.9 SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware 0.3%
• CVE-2026-44650 Critical 9.1 SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 0.6%
• CVE-2026-44648 High 7.5 SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover 0.4%
• CVE-2026-44649 Critical 9.8 SillyTavern: Authentication Bypass via SSO Header Injection 0.2%
• CVE-2026-44652 Medium 6.9 SillyTavern: SSRF vulnerability in the CORS proxy middleware 0.4%
• CVE-2026-46372 High 8.5 SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl 0.9%
• CVE-2026-34526 Medium 5.0 SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 0.2%
• CVE-2026-34524 High 8.3 SillyTavern: Path traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root 0.6%
• CVE-2026-34523 Medium 5.3 SillyTavern: Path traversal allows file existence oracle 0.5%
• CVE-2026-34522 High 8.1 SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory 0.4%
• CVE-2026-26286 High 7.1 SillyTavern has Server-Side Request Forgery (SSRF) via Asset Download Endpoint that Allows Reading Internal Services 0.3%
• CVE-2025-59159 Critical 9.7 SillyTavern Web Interface Vulnerable to DNS Rebinding 0.2%