Oraios vulnerabilities
We track 2 vulnerabilities in Oraios products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
2vulnerabilities
0critical
2high
0exploited
7.7average CVSS score
Latest Oraios vulnerabilities
- 7.1 High severity
serena: Improper Link Resolution Before File Access
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks
- 8.3 High severity
serena: Missing Authentication for Critical Functionality
Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protectio