Skip to content
OpenAdvisories

Vendor

oraios

2 known vulnerabilities.

Products

serena 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-109965

    Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root

    Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlink…

    oraios serena
  • High 8.3
    CVE-2026-49471

    Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

    Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protecti…

    oraios serena serena-agent PyPI