[ Vendor · 8 CVEs ]
decolua
CVEs affecting decolua published in the last 30 days, plus any decolua CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108593 | 10 Oct 2026 | CVSS 6.4 | decolua 9router9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows… | |
| CVE-2026-103530 | 1 Oct 2026 | CVSS 7.3 | decolua 9RouterA vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of… | |
| CVE-2026-56682 | 22 Sep 2026 | CVSS 5.3 | 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing… | Fix |
| CVE-2026-56681 | 22 Sep 2026 | CVSS 7.3 | 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing… | Fix |
| CVE-2026-56678 | 15 Jul 2026 | CVSS 6.4 | 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using… | Fix |
| CVE-2026-56679 | 15 Jul 2026 | CVSS 8.7 | 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without… | Fix |
| CVE-2026-56675 | 10 Jul 2026 | CVSS 8.3 | 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a… | Fix |
| CVE-2026-56676 | 10 Jul 2026 | CVSS 7.4 | 9router: Image prefetch DNS rebinding allows SSRF to internal services9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but… | Fix |