S
Vendor security profile
seaweedfs
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs10
Critical3
CISA KEV0
Public exploit4
Patch rate%50
Avg. CVSS8.4
12-month vulnerability rate
0
0
0
0
0
0
0
2
0
7
0
1
CVE KEV
CVE severity distribution
10toplam CVE
Critical3 (30%)
High7 (70%)
Patch and exploitation view
%50
Verified patch
%0
CISA KEV
%40
Public exploit
5Patch available
0Partial
0Workaround
0Vendor: no patch
5Unknown
Latest vulnerabilities
7.0
CVE-2026-100413
SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments
S
Patch status unknown
7.1
CVE-2026-77611
SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename
S
Patch status unknownEPSS %0
8.1
CVE-2026-77317
SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite
S
Patch status unknownEPSS %0
8.7
CVE-2026-77298
SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy
S
Patch status unknownEPSS %0
7.6
CVE-2026-77368
SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths
S
Patch status unknownEPSS %0
9.3
CVE-2026-73080
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
S
Patch verifiedEPSS %1
8.1
CVE-2026-72921
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
S
Patch verifiedEPSS %0
9.8
CVE-2026-72920
SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
S
Patch verifiedEPSS %1
8.1
CVE-2026-58372
SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys
S
Patch verifiedEPSS %1
10.0
CVE-2026-54917
Path traversal in Seaweedfs
S
Patch verified Public Exploits:1EPSS %2