Vanna

This hub aggregates every CVE we track for Vanna, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 13 most recently published vulnerabilities affecting Vanna.

• CVE-2026-65702Vanna 2.0.2 Path Traversal via FileSystemConversationStore8.6Jul 23, 2026
• CVE-2026-6977vanna-ai vanna Legacy Flask API improper authorization7.3Apr 25, 2026
• CVE-2026-5321vanna-ai vanna FastAPI/Flask Server cross-domain policy4.3Apr 2, 2026
• CVE-2026-5320vanna-ai vanna Chat API Endpoint v2 missing authentication7.3Apr 2, 2026
• CVE-2026-4513vanna-ai vanna base.py ask sql injection6.3Mar 21, 2026
• CVE-2026-4511vanna-ai vanna legacy exec injection6.3Mar 21, 2026
• CVE-2026-4231vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery7.3Mar 16, 2026
• CVE-2026-4230vanna-ai vanna Endpoint __init__.py update_sql sql injection6.3Mar 16, 2026
• CVE-2026-4229vanna-ai vanna bigquery_vector.py remove_training_data sql injection7.3Mar 16, 2026
• CVE-2024-5753Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna7.5Jul 5, 2024
• CVE-2024-5827Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna9.8Jun 28, 2024
• CVE-2024-5826Remote Code Execution via Prompt Injection in vanna-ai/vanna9.8Jun 27, 2024
• CVE-2024-5565Prompt Injection in "ask" API with visualization leads to RCE8.1May 31, 2024