Nnetease-youdao

Products

Exploited and recent CVEs

• CVE-2026-112014 Medium 5.5 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export 0.1%
• CVE-2026-108156 High 7.1 LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json 0.2%
• CVE-2026-90818 Medium 4.3 netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery 0.5%
• CVE-2026-85671 High 7.5 QAnything 2.0.0 Unauthenticated Cross-User File Disclosure 0.6%
• CVE-2026-18995 Medium 4.3 netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure 0.5%
• CVE-2024-12866 High 7.5 Local File Inclusion in netease-youdao/qanything 1.5%
• CVE-2024-8026 High 8.1 CSRF due to overly permissive CORS headers in netease-youdao/qanything 0.2%
• CVE-2024-12864 High 7.5 Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanything 0.9%
• CVE-2024-8027 Medium 6.1 Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything 0.4%
• CVE-2024-8024 High 7.5 CORS Misconfiguration in netease-youdao/qanything 0.3%
• CVE-2024-10264 High 7.5 HTTP Request Smuggling in netease-youdao/qanything 1.0%
• CVE-2024-7099 Critical 9.8 SQL Injection in netease-youdao/qanything 0.6%