{"items":[{"id":"CVE-2026-86115","published":"2026-09-05T09:59:06.026Z","updated":"2026-09-24T14:21:02.444Z","title":"Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path","severity":"MEDIUM","score":5.3,"vendor":"simstudioai","product":"sim","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-13510","published":"2026-06-28T22:15:11.256Z","updated":"2026-06-29T13:43:53.156Z","title":"SimStudioAI sim Password Protection deployment.ts weak hash","severity":"MEDIUM","score":6.3,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2026-3432","published":"2026-03-02T13:01:05.290Z","updated":"2026-03-02T13:32:11.796Z","title":"Sim Studio AI - Unauthenticated OAuth Token Theft","severity":"CRITICAL","score":9.3,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-3431","published":"2026-03-02T13:00:58.829Z","updated":"2026-03-02T13:33:23.987Z","title":"Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion","severity":"CRITICAL","score":9.8,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2025-15099","published":"2025-12-26T04:02:07.111Z","updated":"2025-12-26T15:04:35.405Z","title":"simstudioai sim CRON Secret internal.ts improper authentication","severity":"MEDIUM","score":6.9,"vendor":"simstudioai","product":"sim","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2025-10097","published":"2025-09-08T16:32:06.882Z","updated":"2025-09-09T13:41:12.135Z","title":"SimStudioAI sim route.ts code injection","severity":"MEDIUM","score":5.3,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.0078,"kevAdded":null},{"id":"CVE-2025-10096","published":"2025-09-08T15:32:08.846Z","updated":"2025-09-08T15:54:31.292Z","title":"SimStudioAI sim route.ts server-side request forgery","severity":"MEDIUM","score":5.3,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2025-9805","published":"2025-09-02T00:02:07.900Z","updated":"2025-09-02T19:34:20.352Z","title":"SimStudioAI sim route.ts server-side request forgery","severity":"MEDIUM","score":5.3,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2025-9801","published":"2025-09-01T23:02:06.763Z","updated":"2025-09-02T19:41:17.897Z","title":"SimStudioAI sim path traversal","severity":"MEDIUM","score":5.3,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.00763,"kevAdded":null},{"id":"CVE-2025-9800","published":"2025-09-01T22:32:06.885Z","updated":"2025-09-02T19:45:42.085Z","title":"SimStudioAI sim HTML File route.ts import unrestricted upload","severity":"MEDIUM","score":5.3,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-7114","published":"2025-07-07T05:32:05.686Z","updated":"2025-07-07T16:55:36.080Z","title":"SimStudioAI sim Session route.ts POST missing authentication","severity":"MEDIUM","score":6.9,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.00586,"kevAdded":null},{"id":"CVE-2025-7107","published":"2025-07-07T02:02:07.997Z","updated":"2025-07-07T15:37:13.337Z","title":"SimStudioAI sim route.ts handleLocalFile path traversal","severity":"MEDIUM","score":6.9,"vendor":"SimStudioAI","product":"sim","kev":false,"epss":0.00923,"kevAdded":null}]}