Sciphi-Ai R2r
5 CVEs affecting Sciphi-Ai R2r. Latest disclosed: 2026-10-04. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82526 | Critical | 9.8 | 2026-09-03 | R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the… |
CVE-2026-82527 | High | 7.5 | 2026-09-03 | R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipul… |
CVE-2026-105148 | High | 7.3 | 2026-10-04 | A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component… |
CVE-2026-105147 | High | 7.3 | 2026-10-04 | A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argumen… |
CVE-2026-82271 | Medium | 6.5 | 2026-08-28 | R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' co… |