8
CVEs
0
Critical
0
High
0
KEV
8
PoC
0
Unpatched C/H
12.5%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
0
LOW
8
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-16076 | Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate other users by manipulating the Username argument in the OpenAPI chat_send endpoint. Affected is the function OpenApiRoute.chat_send in astrbot/dashboard/routes/open_api.py, exposing confidentiality, integrity, and availability at a limited level. A public proof-of-concept exploit exists on GitHub; the vendor did not respond to responsible disclosure, and no patch has been released. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-16075 | Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat sessions belonging to other users by manipulating the Username parameter in the session-listing endpoint, affecting all versions up to and including 4.25.5. The vulnerable function `OpenApiRoute.get_chat_sessions` in `astrbot/dashboard/routes/open_api.py` fails to verify that the requesting user is authorized to access the target Username's session data (CWE-639 IDOR). A public proof-of-concept exploit exists on GitHub; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the low attack complexity and published POC materially lower the exploitation barrier. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-15501 | Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce the server into issuing arbitrary HTTP requests via a manipulated `mcp_server_config.url` parameter. All AstrBot versions through 4.25.2 are affected via the `ToolsRoute.test_mcp_connection` function in `astrbot/dashboard/routes/tools.py`. A publicly available proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no vendor-issued patch at time of analysis. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-16074 | Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make the server issue arbitrary HTTP requests by injecting a malicious URL into the download_url, download_urls, or proxy arguments of the plugin update handler. The affected endpoint resides in astrbot/dashboard/routes/plugin.py within the update_plugin and update_all_plugins functions. A public proof-of-concept exploit exists on GitHub, and the vendor did not respond to the coordinated disclosure, leaving users without an official patch. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-15499 | Improper authorization in AstrBot's Scheduled Task Handler allows a remote low-privileged user to bypass authorization controls by manipulating the payload["note"] argument in FutureTaskTool.call (astrbot/core/tools/cron_tools.py), affecting all versions up to and including 4.25.2. A publicly available proof-of-concept exploit (GitHub gist) demonstrates exploitation. No patch has been released and the vendor did not respond to disclosure; EPSS and CVSS 4.0 score this at 5.3, indicating moderate-to-low real-world severity, but the active POC elevates practical risk for deployed instances. Not currently listed in CISA KEV. | LOW | 2.1 | 0.2% | 30 |
PoC
No patch
|
| CVE-2026-15500 | Server-side request forgery in AstrBot up to version 4.25.2 allows authenticated remote attackers to cause the server to issue arbitrary HTTP requests by supplying a malicious value for the `custom_registry` parameter at the `market_list` plugin marketplace endpoint. The affected function is `get_online_plugins` in `astrbot/dashboard/routes/plugin.py`. A public proof-of-concept exploit is available on GitHub, though this vulnerability is not listed in the CISA KEV catalog. The CVSS 4.0 score of 2.1 reflects the authentication barrier and constrained impact, making this a lower-priority but tactically exploitable issue for attackers with dashboard access. | LOW | 2.1 | 0.2% | 30 |
PoC
No patch
|
| CVE-2026-17529 | Incorrect authorization in AstrBot up to 4.25.5 allows remote authenticated users to bypass persona-based tool restrictions and execute unauthorized function tools. A public exploit exists, and a patch is available from the vendor. No active exploitation has been reported via CISA KEV, but the public exploit increases risk for deployments using persona tool controls. | LOW | 2.1 | 0.4% | 30 |
PoC
|
| CVE-2026-16073 | Cross-site scripting in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated remote attackers to inject and execute malicious scripts via the Text-to-Image (T2I) feature, specifically through the `Star.text_to_image` and `NetworkRenderStrategy.render` functions in `astrbot/core/star/base.py`. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to responsible disclosure, meaning no official patch exists at time of analysis. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), but the public POC materially lowers the exploitation bar. | LOW | 2.0 | 0.2% | 30 |
PoC
No patch
|