cve.bz

3xpyth0n ideon vulnerabilities in 2026, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 6.9CVE-2026-68507EPSS 0.5%

    ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose …

  2. 5.3CVE-2026-65968EPSS 0.3%

    ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the parallel validateMcpUrl() in lib/security/validators.ts) perform SSRF host-blocking by string/rege…

  3. 8.7CVE-2026-65965EPSS 0.4%

    ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role…

  4. 7.1CVE-2026-103980EPSS 0.3%

    ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a nar…