CyberSecBulletin

Comfy vulnerabilities

We track 2 vulnerabilities in Comfy products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on January 5, 2026.

2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score

Latest Comfy vulnerabilities

  • 7.5 High severity

    Comfyui-manager: Unprotected Alternate Channel

    CVE-2025-67303ComfyEPSS 1.39%

    An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web

  • 7.5 High severity

    comfyanonymous/comfyui: Server-Side Request Forgery

    CVE-2024-12882Comfyanonymous

    comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs `POST /internal/models/download` and `GET /view`, allowing attackers to abuse the vi