https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T10:39:01.849016+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-65012 fkie_cve-2026-65012 2026-10-02T10:39:01.903215+00:00

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.

 https://vulnerability.circl.lu/vuln/ghsa-r6m9-hrqm-hx9h GHSA-r6m9-hrqm-hx9h 2026-10-02T10:39:01.903377+00:00

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.