Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-110775

Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access

Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nexent
Products
Nexent
CVE-2026-31215

Unauthorized Arbitrary File Deletion via ElasticSearch in Nexent v1.7.5.2

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /{index_name}/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied path_or_url parameter. This allows unauthenticated remote attackers to send crafted requests that trigger the deletion of arbitrary documents from ElasticSearch indices and corresponding files from the MinIO storage system. Successful exploitation leads to data destruction and denial of service.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Modelengine-group Nexent
Products
Nexent Nexent
CVE-2026-31216

Unauthorized Deletion of Files via Backend REST API

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{object_name:path} endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send crafted requests with a user-controlled object_name path parameter to delete arbitrary files from the underlying MinIO storage system. Successful exploitation leads to data loss and denial of service.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Modelengine-group Nexent
Products
Nexent Nexent