https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-8027.htmlhttps://patchthecve.com/cve/CVE-2024-8027.htmlWed, 17 Jun 2026 08:21:42 +0000MEDIUM 6.1: A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything. Attackers can upload malicious knowledge files to the knowledge base, which can trigger XSS attacks during user chats. This vulnerability affects all versions prior to the fix.https://patchthecve.com/cve/CVE-2024-8026.htmlhttps://patchthecve.com/cve/CVE-2024-8026.htmlWed, 17 Jun 2026 08:21:42 +0000HIGH 8.1: A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, https://patchthecve.com/cve/CVE-2024-8024.htmlhttps://patchthecve.com/cve/CVE-2024-8024.htmlWed, 17 Jun 2026 08:21:42 +0000HIGH 7.5: A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially leading to sensitive information exposure. Properly implementing a restrictive CORS policy is crucial to prevent such security ihttps://patchthecve.com/cve/CVE-2024-12866.htmlhttps://patchthecve.com/cve/CVE-2024-12866.htmlWed, 17 Jun 2026 07:00:39 +0000HIGH 7.5: A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration filehttps://patchthecve.com/cve/CVE-2024-12864.htmlhttps://patchthecve.com/cve/CVE-2024-12864.htmlWed, 17 Jun 2026 07:00:39 +0000HIGH 7.5: A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a large filhttps://patchthecve.com/cve/CVE-2024-10264.htmlhttps://patchthecve.com/cve/CVE-2024-10264.htmlWed, 17 Jun 2026 06:55:15 +0000CRITICAL 9.8: HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potehttps://patchthecve.com/cve/CVE-2024-7099.htmlhttps://patchthecve.com/cve/CVE-2024-7099.htmlWed, 17 Jun 2026 08:19:21 +0000CRITICAL 9.8: netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_files`, and `get_file_by_status`. An attackehttps://patchthecve.com/cve/CVE-2024-25722.htmlhttps://patchthecve.com/cve/CVE-2024-25722.htmlWed, 17 Jun 2026 07:16:28 +0000CRITICAL 9.8: qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.