Vvanna-ai

Products

Exploited and recent CVEs

• CVE-2026-65702 High 8.6 Vanna 2.0.2 Path Traversal via FileSystemConversationStore 0.6%
• CVE-2026-6977 High 7.3 vanna-ai vanna Legacy Flask API improper authorization 0.3%
• CVE-2026-5321 Medium 4.3 vanna-ai vanna FastAPI/Flask Server cross-domain policy 0.2%
• CVE-2026-5320 High 7.3 vanna-ai vanna Chat API Endpoint v2 missing authentication 0.4%
• CVE-2026-4513 Medium 6.3 vanna-ai vanna base.py ask sql injection 0.2%
• CVE-2026-4511 Medium 6.3 vanna-ai vanna legacy exec injection 0.2%
• CVE-2026-4231 High 7.3 vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery 0.3%
• CVE-2026-4230 Medium 6.3 vanna-ai vanna Endpoint __init__.py update_sql sql injection 0.2%
• CVE-2026-4229 High 7.3 vanna-ai vanna bigquery_vector.py remove_training_data sql injection 0.3%
• CVE-2024-7764 High 8.1 SQL Injection in vanna-ai/vanna 0.8%
• CVE-2024-8055 High 7.5 Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vanna 0.7%
• CVE-2024-6841 Medium 6.5 CSRF in vanna-ai/vanna 0.2%
• CVE-2024-8099 High 8.3 Server-Side Request Forgery (SSRF) in vanna-ai/vanna 0.4%
• CVE-2024-5753 High 7.5 Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna 0.6%
• CVE-2024-5827 Critical 9.8 Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna 3.4%
• CVE-2024-5826 Critical 9.8 Remote Code Execution via Prompt Injection in vanna-ai/vanna 0.9%