comfyui

Records7

1. closed
   ComfyUI + custom nodes CVE-2026-123790: ComfyUI‑Easy‑Use path traversal allows code execution

   Patch now · Disclosed · since 12 Nov 2026 · CVE-2026-123790

   AI
2. closed6.3
   ComfyUI + custom nodes CVE-2026-108962: Code injection in comfyui_segment_anything

   Patch now · Disclosed · since 13 Oct 2026 · CVE-2026-108962

   AI
3. closed8.5
   ComfyUI + custom nodes CVE-2026-92816: ComfyUI path traversal leads to code execution

   Patch now · Disclosed · since 16 Sep 2026 · CVE-2026-92816

   AI
4. closed8.2
   ComfyUI + custom nodes CVE-2026-56670: Stored XSS via SVG handling in ComfyUI view endpoint

   Patch now · Disclosed · since 31 Jul 2026 · CVE-2026-56670

   AI
5. closed8.2
   ComfyUI + custom nodes CVE-2026-56672: Stored XSS vulnerability in ComfyUI userdata endpoint

   Patch now · Disclosed · since 31 Jul 2026 · CVE-2026-56672

   AI
6. closed3.1
   ComfyUI + custom nodes CVE-2025-6107: Attribute manipulation vulnerability in ComfyUI

   Patch now · Disclosed · since 16 Jun 2025 · CVE-2025-6107

   AI
7. closed4.3
   ComfyUI + custom nodes CVE-2025-6092: Cross-site scripting vulnerability in ComfyUI

   Patch now · Disclosed · since 15 Jun 2025 · CVE-2025-6092

   AI