onyx records
6 published records for vendor onyx.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-639 Authorization Bypass Through User-Controlled Key3
- CWE-1100 Insufficient Isolation of System-Dependent Functions1
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
- CWE-862 Missing Authorization1
The weakness classes this vendor ships most often: where to look.
CWEAll records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
32Monitor | CVE-2024-7767No exploit | Improper Access Control in danswer-ai/dansweronyx · onyx · CWE-862 | High8.1 | — | 0.6% | Mar 20, 2025 |
26Monitor | CVE-2024-9612No exploit | Unauthorized Access in danswer-ai/dansweronyx · onyx · CWE-1100 | Medium6.5 | — | 0.7% | Mar 20, 2025 |
26Monitor | CVE-2026-42277No exploit | Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users filesonyx · onyx · CWE-639 | Medium6.5 | — | 0.2% | May 8, 2026 |
21Monitor | CVE-2025-51479No exploit | Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbonyx · onyx · CWE-639 | Medium5.4 | — | 0.3% | Jul 22, 2025 |
17Monitor | CVE-2026-42276No exploit | Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessionsonyx · onyx · CWE-639 | Medium4.3 | — | 0.2% | May 8, 2026 |
8Monitor | CVE-2025-7894No exploit | Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injectiononyx · onyx · CWE-74 | Low2.1 | — | 0.6% | Jul 20, 2025 |
- CVE-2024-776732Monitor
Improper Access Control in danswer-ai/danswer
HighCVSS 8.1No exploitEPSS 0%onyx · onyxMar 20, 2025
- CVE-2024-961226Monitor
Unauthorized Access in danswer-ai/danswer
MediumCVSS 6.5No exploitEPSS 0%onyx · onyxMar 20, 2025
- CVE-2026-4227726Monitor
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
MediumCVSS 6.5No exploitEPSS 0%onyx · onyxMay 8, 2026
- CVE-2025-5147921Monitor
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arb
MediumCVSS 5.4No exploitEPSS 0%onyx · onyxJul 22, 2025
- CVE-2026-4227617Monitor
Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
MediumCVSS 4.3No exploitEPSS 0%onyx · onyxMay 8, 2026
- CVE-2025-78948Monitor
Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection
LowCVSS 2.1No exploitEPSS 0%onyx · onyxJul 20, 2025