All 3 CVE vulnerabilities found in serena, with AI-generated Chinese analysis, references, and POCs.
Vendor: oraios
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-109965 | Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root CWE-59 | 7.1 | High | 2026-10-13 |
| CVE-2026-38924 | Oraios AI Serena 权限许可和访问控制问题漏洞 CWE-669 | 2.9 | Low | 2026-09-14 |
| CVE-2026-49471 | Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE CWE-306 | 8.3 | High | 2026-07-07 |
All 3 known CVE vulnerabilities affecting serena with full Chinese analysis, references, and POCs where available.