Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was found in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function update_sql/run_sql of the file src/vanna/legacy/flask/__init__.py of the component Endpoint. Performing a manipulation results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-16 | 2 | Disclosure1Patch1 |
| 2026-04-13 | 1 | General1 |
📌 Top CVEs recientes (CVSS>=7.0): 1. 💉 CVE-2026-4235 (CVSS: 7.3) 2. 💉 CVE-2026-4232 (CVSS: 7.3) 3. 🕷️ CVE-2026-4231 (CVSS: 7.3) 4. 💉 CVE-2026-4229 (CVSS: 7.3) 5. 🧱 CVE-2026-4227 (CVSS: 8.8) #CyberSecurity #CVE #Infosec
Post summary
The post lists five recent CVEs with high CVSS scores, but offers no further details or actionable information.
🚨 Atenção, profissionais de segurança! A vulnerabilidade SSRF no vanna-ai (até v2.0.2) pode permitir que atacantes realizem requisições arbitrárias. Atualize agora e isole sua rede para evitar riscos! 🔒 Saiba mais: https://www.tenable.com/cve/CVE-2026-4231 #CyberSecurity #Vulnerability #SSRF
Post summary
The tweet highlights an SSRF flaw in vanna‑ai (up to v2.0.2) and urges users to patch immediately and isolate the network, but offers no exploit code or evidence of active attacks.
CVE-2026-4231 A vulnerability was found in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function update_sql/run_sql of the file src/vanna/legacy/flask/__init__.p… https://www.cve.org/CVERecord?id=CVE-2026-4231
Post summary
Vulnerability CVE-2026-4231 has been identified in vanna-ai vanna versions up to 2.0.2, specifically affecting the update_sql/run_sql function within the Flask legacy module. The CVE record links to detailed information on the CVE.org site.