https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-3432.htmlhttps://patchthecve.com/cve/CVE-2026-3432.htmlWed, 17 Jun 2026 10:43:35 +0000CRITICAL 9.1: On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying theihttps://patchthecve.com/cve/CVE-2026-3431.htmlhttps://patchthecve.com/cve/CVE-2026-3431.htmlWed, 17 Jun 2026 10:43:34 +0000CRITICAL 9.8: On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reahttps://patchthecve.com/cve/CVE-2025-15099.htmlhttps://patchthecve.com/cve/CVE-2025-15099.htmlWed, 07 Oct 2026 13:10:00 +0000HIGH 7.3: A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the component CRON Secret Handler. The manipulation of the argument INTERNAL_API_SECRET leads to improper authentication. It is possible to initiate thhttps://patchthecve.com/cve/CVE-2025-10097.htmlhttps://patchthecve.com/cve/CVE-2025-10097.htmlWed, 30 Sep 2026 23:10:00 +0000MEDIUM 6.3: A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.https://patchthecve.com/cve/CVE-2025-10096.htmlhttps://patchthecve.com/cve/CVE-2025-10096.htmlWed, 17 Jun 2026 08:27:40 +0000MEDIUM 6.3: A vulnerability was determined in SimStudioAI sim up to 1.0.0. This affects an unknown function of the file apps/sim/app/api/files/parse/route.ts. Executing manipulation of the argument filePath can lead to server-side request forgery. The attack can be executed remotely. The exploit has been publichttps://patchthecve.com/cve/CVE-2025-9801.htmlhttps://patchthecve.com/cve/CVE-2025-9801.htmlWed, 17 Jun 2026 10:09:47 +0000MEDIUM 5.4: A security vulnerability has been detected in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. This affects an unknown part. The manipulation of the argument filePath leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and mahttps://patchthecve.com/cve/CVE-2025-9800.htmlhttps://patchthecve.com/cve/CVE-2025-9800.htmlThu, 01 Oct 2026 16:10:00 +0000MEDIUM 6.3: A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file apps/sim/app/api/files/upload/route.ts of the component HTML File Parser. Executing manipulation of the argument File can lead to unrestricted uhttps://patchthecve.com/cve/CVE-2025-7114.htmlhttps://patchthecve.com/cve/CVE-2025-7114.htmlWed, 17 Jun 2026 10:04:18 +0000HIGH 7.3: A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability is the function POST of the file apps/sim/app/api/files/upload/route.ts of the component Session Handler. The manipulation of the argument Reqhttps://patchthecve.com/cve/CVE-2025-7107.htmlhttps://patchthecve.com/cve/CVE-2025-7107.htmlWed, 17 Jun 2026 10:04:17 +0000MEDIUM 5.3: A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The expl