Coze-dev
Coze-dev Security Releases - October 2026
coze-dev-2026-10 Oct 1, 2026 Source: Vendor
Coze-dev security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-77934
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
6 lines
Showing 1–6 of 6
CVE-2026-77934
BR2026-0000-041463
coze-studio
unclaimed
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attacker...
Credited as Noy Pearl
CVE-2026-77934
BR2026-0000-041464
coze-studio
unclaimed
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attacker...
Credited as Michael Sromin
CVE-2026-77934
BR2026-0000-041465
coze-studio
unclaimed
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attacker...
Credited as Ophir Dror
CVE-2026-77935
BR2026-0000-041466
coze-studio
unclaimed
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowID...
Credited as Noy Pearl
CVE-2026-77935
BR2026-0000-041467
coze-studio
unclaimed
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowID...
Credited as Michael Sromin
CVE-2026-77935
BR2026-0000-041468
coze-studio
unclaimed
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowID...
Credited as Ophir Dror