Qhkm vulnerabilities
We track 2 vulnerabilities in Qhkm products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 12, 2026.
2vulnerabilities
1critical
1high
0exploited
9.0average CVSS score
Latest Qhkm vulnerabilities
- 9.8 Critical severity
zeptoclaw: Improper Limitation of a Pathname to a Restricted Directory
ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6.
- 8.2 High severity
zeptoclaw: Missing Authentication for Critical Functionality
ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and