Simstudioai Sim vulnerabilities

• simstudioai sim Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path CVE-2026-86115 5.3 MediumSeptember 5, 2026
• simstudioai sim SimStudioAI sim Password Protection deployment.ts weak hash CVE-2026-13510 6.3 MediumJune 28, 2026
• sim Sim Studio AI - Unauthenticated OAuth Token Theft CVE-2026-3432 9.3 CriticalMarch 2, 2026
• sim Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion CVE-2026-3431 9.8 CriticalMarch 2, 2026
• sim simstudioai sim CRON Secret internal.ts improper authentication CVE-2025-15099 6.9 MediumDecember 26, 2025
• sim SimStudioAI sim route.ts code injection CVE-2025-10097 5.3 MediumSeptember 8, 2025
• sim SimStudioAI sim route.ts server-side request forgery CVE-2025-10096 5.3 MediumSeptember 8, 2025
• sim SimStudioAI sim route.ts server-side request forgery CVE-2025-9805 5.3 MediumSeptember 2, 2025
• sim SimStudioAI sim path traversal CVE-2025-9801 5.3 MediumSeptember 1, 2025
• sim SimStudioAI sim HTML File route.ts import unrestricted upload CVE-2025-9800 5.3 MediumSeptember 1, 2025
• sim SimStudioAI sim Session route.ts POST missing authentication CVE-2025-7114 6.9 MediumJuly 7, 2025
• sim SimStudioAI sim route.ts handleLocalFile path traversal CVE-2025-7107 6.9 MediumJuly 7, 2025