oraios
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| serena | 2 | – | Oct 13, 2026 |
Exploited and recent CVEs
- CVE-2026-109965 Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root 0.2%
- CVE-2026-49471 Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE 0.4%