sim records
10 published records for vendor sim.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2
- CWE-287 Improper Authentication2
- CWE-862 Missing Authorization2
- CWE-918 Server-Side Request Forgery (SSRF)2
- CWE-284 Improper Access Control1
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
10 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2026-3431No exploit | Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletionsim · sim · CWE-862 | Critical9.8 | — | 0.6% | Mar 2, 2026 |
37Monitor | CVE-2026-3432No exploit | Sim Studio AI - Unauthenticated OAuth Token Theftsim · sim · CWE-862 | Critical9.3 | — | 0.5% | Mar 2, 2026 |
22Monitor | CVE-2025-7107No exploit | SimStudioAI sim route.ts handleLocalFile path traversalsim · sim · CWE-22 | Medium5.5 | — | 0.9% | Jul 6, 2025 |
22Monitor | CVE-2025-15099No exploit | simstudioai sim CRON Secret internal.ts improper authenticationsim · sim · CWE-287 | Medium5.5 | — | 0.8% | Dec 26, 2025 |
22Monitor | CVE-2025-7114No exploit | SimStudioAI sim Session route.ts POST missing authenticationsim · sim · CWE-287 | Medium5.5 | — | 0.6% | Jul 7, 2025 |
21Monitor | CVE-2025-10097No exploit | SimStudioAI sim route.ts code injectionsim · sim · CWE-74 | Medium5.3 | — | 0.8% | Sep 8, 2025 |
8Monitor | CVE-2025-9801No exploit | SimStudioAI sim path traversalsim · sim · CWE-22 | Low2.1 | — | 0.7% | Sep 1, 2025 |
8Monitor | CVE-2025-9800No exploit | SimStudioAI sim HTML File route.ts import unrestricted uploadsim · sim · CWE-284 | Low2.1 | — | 0.3% | Sep 1, 2025 |
8Monitor | CVE-2025-9805No exploit | SimStudioAI sim route.ts server-side request forgerysim · sim · CWE-918 | Low2.1 | — | 0.3% | Sep 1, 2025 |
8Monitor | CVE-2025-10096No exploit | SimStudioAI sim route.ts server-side request forgerysim · sim · CWE-918 | Low2.1 | — | 0.3% | Sep 8, 2025 |
- CVE-2026-343139Monitor
Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion
CriticalCVSS 9.8No exploitEPSS 1%sim · simMar 2, 2026
- CVE-2026-343237Monitor
Sim Studio AI - Unauthenticated OAuth Token Theft
CriticalCVSS 9.3No exploitEPSS 0%sim · simMar 2, 2026
- CVE-2025-710722Monitor
SimStudioAI sim route.ts handleLocalFile path traversal
MediumCVSS 5.5No exploitEPSS 1%sim · simJul 6, 2025
- CVE-2025-1509922Monitor
simstudioai sim CRON Secret internal.ts improper authentication
MediumCVSS 5.5No exploitEPSS 1%sim · simDec 26, 2025
- CVE-2025-711422Monitor
SimStudioAI sim Session route.ts POST missing authentication
MediumCVSS 5.5No exploitEPSS 1%sim · simJul 7, 2025
- CVE-2025-1009721Monitor
SimStudioAI sim route.ts code injection
MediumCVSS 5.3No exploitEPSS 1%sim · simSep 8, 2025
- CVE-2025-98018Monitor
SimStudioAI sim path traversal
LowCVSS 2.1No exploitEPSS 1%sim · simSep 1, 2025
- CVE-2025-98008Monitor
SimStudioAI sim HTML File route.ts import unrestricted upload
LowCVSS 2.1No exploitEPSS 0%sim · simSep 1, 2025
- CVE-2025-98058Monitor
SimStudioAI sim route.ts server-side request forgery
LowCVSS 2.1No exploitEPSS 0%sim · simSep 1, 2025
- CVE-2025-100968Monitor
SimStudioAI sim route.ts server-side request forgery
LowCVSS 2.1No exploitEPSS 0%sim · simSep 8, 2025