Veille CVE

Recherche « QuivrHQ quivr »

2 CVE

Critique 0 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « QuivrHQ quivr » ✕
  1. CVE-2026-82284 8.1 Élevée

    QuivrHQ quivr

    Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.

  2. CVE-2026-82280 7.1 Élevée

    QuivrHQ quivr

    Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users.