Volcengine Openviking
8 CVEs affecting Volcengine Openviking. Latest disclosed: 2026-08-21. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22207 | Critical | 9.8 | 2026-02-26 | OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT p… |
CVE-2026-40525 | Critical | 9.1 | 2026-04-17 | OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fa… |
CVE-2026-22681 | High | 8.5 | 2026-08-21 | OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network servi… |
CVE-2026-28518 | High | 7.8 | 2026-03-03 | OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to wr… |
CVE-2026-75480 | Medium | 6.5 | 2026-08-17 | OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read al… |
CVE-2026-22680 | Medium | 5.3 | 2026-04-07 | OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate… |
CVE-2026-34999 | Medium | 5.3 | 2026-04-01 | OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers t… |
CVE-2026-13507 | Medium | 5.0 | 2026-06-28 | A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_t… |