Cinnamon Kotaemon
5 CVEs affecting Cinnamon Kotaemon. Latest disclosed: 2026-08-04. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69098 | Critical | 9.8 | 2026-08-04 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiat… |
CVE-2025-56527 | High | 7.5 | 2025-11-18 | Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage. |
CVE-2025-63914 | Medium | 6.5 | 2025-11-24 | An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not check the contents of… |
CVE-2025-53358 | Medium | 6.5 | 2025-07-02 | kotaemon is an open-source RAG-based tool for document comprehension. From versions 0.10.6 and prior, in libs/ktem/ktem/index/file/ui.py, the index_fn method a… |
CVE-2025-56526 | Medium | 6.1 | 2025-11-18 | Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF. |