Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-124574 (GCVE-0-2026-124574)

Vulnerability from nvd – Published: 2026-11-09 06:30 – Updated: 2026-11-09 06:30 X_Open Source

Title

chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization

Summary

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CWE

CWE-285 - Improper Authorization
CWE-266 - Incorrect Privilege Assignment

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3824 records in the last 180 days details

References

9 references

URL	Tags
https://vuldb.com/vuln/432920	vdb-entrytechnical-description
https://vuldb.com/vuln/432920/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124574	third-party-advisory
https://vuldb.com/submit/1036006	third-party-advisory
https://github.com/chenyme/grok2api/issues/1066	issue-tracking
https://github.com/chenyme/grok2api/pull/1067	issue-trackingpatch
https://github.com/chenyme/grok2api/commit/199b3a…	patch
https://github.com/chenyme/grok2api/releases/tag/v3.1.7	patch
https://github.com/chenyme/grok2api/	product

Impacted products

1 product

Vendor	Product	Version
chenyme	grok2api	Affected: 3.1.0 Affected: 3.1.1 Affected: 3.1.2 Affected: 3.1.3 Affected: 3.1.4 Affected: 3.1.5 Affected: 3.1.6 Unaffected: 3.1.7 cpe:2.3:a:chenyme:grok2api::::::::

Credits

carfeii (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Video Job Retry Handler"
          ],
          "product": "grok2api",
          "vendor": "chenyme",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.1.1"
            },
            {
              "status": "affected",
              "version": "3.1.2"
            },
            {
              "status": "affected",
              "version": "3.1.3"
            },
            {
              "status": "affected",
              "version": "3.1.4"
            },
            {
              "status": "affected",
              "version": "3.1.5"
            },
            {
              "status": "affected",
              "version": "3.1.6"
            },
            {
              "status": "unaffected",
              "version": "3.1.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "carfeii (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T06:30:32.946Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-432920 | chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/432920"
        },
        {
          "name": "VDB-432920 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/432920/cti"
        },
        {
          "name": "CVE-2026-124574 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124574"
        },
        {
          "name": "Submit #1036006 | https://github.com/chenyme/grok2api/issues/1066 grok2api v3.1.6 (commit 906b9493b099d192381c698d4e320fafeccb851c) Incorrect Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1036006"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/chenyme/grok2api/issues/1066"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/pull/1067"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/commit/199b3abecc14907176dae1f1cacf125419caa94d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/chenyme/grok2api/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-08T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-08T17:58:06.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124574",
    "datePublished": "2026-11-09T06:30:32.946Z",
    "dateReserved": "2026-11-08T16:53:01.460Z",
    "dateUpdated": "2026-11-09T06:30:32.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123788 (GCVE-0-2026-123788)

Vulnerability from nvd – Published: 2026-11-06 21:15 – Updated: 2026-11-06 21:15 X_Open Source

Title

chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow

Summary

A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

CWE

CWE-841 - Enforcement of Behavioral Workflow
CWE-840 - Business Logic Errors

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3824 records in the last 180 days details

References

9 references

URL	Tags
https://vuldb.com/vuln/431934	vdb-entry
https://vuldb.com/vuln/431934/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-123788	third-party-advisory
https://vuldb.com/submit/1033606	third-party-advisory
https://github.com/chenyme/grok2api/issues/1072	issue-tracking
https://github.com/chenyme/grok2api/pull/1073	issue-trackingpatch
https://github.com/chenyme/grok2api/commit/7ad0f7…	patch
https://github.com/chenyme/grok2api/releases/tag/v3.1.7	patch
https://github.com/chenyme/grok2api/	product

Impacted products

1 product

Vendor	Product	Version
chenyme	grok2api	Affected: 3.1.0 Affected: 3.1.1 Affected: 3.1.2 Affected: 3.1.3 Affected: 3.1.4 Affected: 3.1.5 Affected: 3.1.6 Unaffected: 3.1.7 cpe:2.3:a:chenyme:grok2api::::::::

Credits

carfeii (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "STT Billing"
          ],
          "product": "grok2api",
          "vendor": "chenyme",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.1.1"
            },
            {
              "status": "affected",
              "version": "3.1.2"
            },
            {
              "status": "affected",
              "version": "3.1.3"
            },
            {
              "status": "affected",
              "version": "3.1.4"
            },
            {
              "status": "affected",
              "version": "3.1.5"
            },
            {
              "status": "affected",
              "version": "3.1.6"
            },
            {
              "status": "unaffected",
              "version": "3.1.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "carfeii (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-841",
              "description": "Enforcement of Behavioral Workflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-840",
              "description": "Business Logic Errors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:15:17.807Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-431934 | chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/431934"
        },
        {
          "name": "VDB-431934 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/431934/cti"
        },
        {
          "name": "CVE-2026-123788 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-123788"
        },
        {
          "name": "Submit #1033606 | https://github.com/chenyme/ grok2api v3.1.6 Improper Enforcement of Behavioral Workflow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1033606"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/chenyme/grok2api/issues/1072"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/pull/1073"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/chenyme/grok2api/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-06T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-06T15:49:41.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-123788",
    "datePublished": "2026-11-06T21:15:17.807Z",
    "dateReserved": "2026-11-06T14:44:36.840Z",
    "dateUpdated": "2026-11-06T21:15:17.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123748 (GCVE-0-2026-123748)

Vulnerability from nvd – Published: 2026-11-06 17:15 – Updated: 2026-11-06 17:15 X_Open Source

Title

chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption

Summary

A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

CWE

CWE-400 - Resource Consumption
CWE-404 - Denial of Service

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3824 records in the last 180 days details

References

9 references

URL	Tags
https://vuldb.com/vuln/431905	vdb-entrytechnical-description
https://vuldb.com/vuln/431905/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-123748	third-party-advisory
https://vuldb.com/submit/1033605	third-party-advisory
https://github.com/chenyme/grok2api/issues/1071	issue-tracking
https://github.com/chenyme/grok2api/pull/1073	issue-trackingpatch
https://github.com/chenyme/grok2api/commit/7ad0f7…	patch
https://github.com/chenyme/grok2api/releases/tag/v3.1.7	patch
https://github.com/chenyme/grok2api/	product

Impacted products

1 product

Vendor	Product	Version
chenyme	grok2api	Affected: 3.1.0 Affected: 3.1.1 Affected: 3.1.2 Affected: 3.1.3 Affected: 3.1.4 Affected: 3.1.5 Affected: 3.1.6 Unaffected: 3.1.7 cpe:2.3:a:chenyme:grok2api::::::::

Credits

carfeii (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "WebSocket Proxy"
          ],
          "product": "grok2api",
          "vendor": "chenyme",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.1.1"
            },
            {
              "status": "affected",
              "version": "3.1.2"
            },
            {
              "status": "affected",
              "version": "3.1.3"
            },
            {
              "status": "affected",
              "version": "3.1.4"
            },
            {
              "status": "affected",
              "version": "3.1.5"
            },
            {
              "status": "affected",
              "version": "3.1.6"
            },
            {
              "status": "unaffected",
              "version": "3.1.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "carfeii (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T17:15:20.058Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-431905 | chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/431905"
        },
        {
          "name": "VDB-431905 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/431905/cti"
        },
        {
          "name": "CVE-2026-123748 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-123748"
        },
        {
          "name": "Submit #1033605 | https://github.com/chenyme/ grok2api v3.1.6 Uncontrolled Resource Consumption",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1033605"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/chenyme/grok2api/issues/1071"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/pull/1073"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/chenyme/grok2api/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-06T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-06T14:03:40.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-123748",
    "datePublished": "2026-11-06T17:15:20.058Z",
    "dateReserved": "2026-11-06T12:58:35.166Z",
    "dateUpdated": "2026-11-06T17:15:20.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124574 (GCVE-0-2026-124574)

Vulnerability from cvelistv5 – Published: 2026-11-09 06:30 – Updated: 2026-11-09 06:30 X_Open Source

Title

chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization

Summary

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CWE

CWE-285 - Improper Authorization
CWE-266 - Incorrect Privilege Assignment

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3824 records in the last 180 days details

References

9 references

URL	Tags
https://vuldb.com/vuln/432920	vdb-entrytechnical-description
https://vuldb.com/vuln/432920/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124574	third-party-advisory
https://vuldb.com/submit/1036006	third-party-advisory
https://github.com/chenyme/grok2api/issues/1066	issue-tracking
https://github.com/chenyme/grok2api/pull/1067	issue-trackingpatch
https://github.com/chenyme/grok2api/commit/199b3a…	patch
https://github.com/chenyme/grok2api/releases/tag/v3.1.7	patch
https://github.com/chenyme/grok2api/	product

Impacted products

1 product

Vendor	Product	Version
chenyme	grok2api	Affected: 3.1.0 Affected: 3.1.1 Affected: 3.1.2 Affected: 3.1.3 Affected: 3.1.4 Affected: 3.1.5 Affected: 3.1.6 Unaffected: 3.1.7 cpe:2.3:a:chenyme:grok2api::::::::

Credits

carfeii (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Video Job Retry Handler"
          ],
          "product": "grok2api",
          "vendor": "chenyme",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.1.1"
            },
            {
              "status": "affected",
              "version": "3.1.2"
            },
            {
              "status": "affected",
              "version": "3.1.3"
            },
            {
              "status": "affected",
              "version": "3.1.4"
            },
            {
              "status": "affected",
              "version": "3.1.5"
            },
            {
              "status": "affected",
              "version": "3.1.6"
            },
            {
              "status": "unaffected",
              "version": "3.1.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "carfeii (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T06:30:32.946Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-432920 | chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/432920"
        },
        {
          "name": "VDB-432920 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/432920/cti"
        },
        {
          "name": "CVE-2026-124574 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124574"
        },
        {
          "name": "Submit #1036006 | https://github.com/chenyme/grok2api/issues/1066 grok2api v3.1.6 (commit 906b9493b099d192381c698d4e320fafeccb851c) Incorrect Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1036006"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/chenyme/grok2api/issues/1066"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/pull/1067"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/commit/199b3abecc14907176dae1f1cacf125419caa94d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/chenyme/grok2api/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-08T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-08T17:58:06.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124574",
    "datePublished": "2026-11-09T06:30:32.946Z",
    "dateReserved": "2026-11-08T16:53:01.460Z",
    "dateUpdated": "2026-11-09T06:30:32.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123788 (GCVE-0-2026-123788)

Vulnerability from cvelistv5 – Published: 2026-11-06 21:15 – Updated: 2026-11-06 21:15 X_Open Source

Title

chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow

Summary

A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

CWE

CWE-841 - Enforcement of Behavioral Workflow
CWE-840 - Business Logic Errors

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3824 records in the last 180 days details

References

9 references

URL	Tags
https://vuldb.com/vuln/431934	vdb-entry
https://vuldb.com/vuln/431934/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-123788	third-party-advisory
https://vuldb.com/submit/1033606	third-party-advisory
https://github.com/chenyme/grok2api/issues/1072	issue-tracking
https://github.com/chenyme/grok2api/pull/1073	issue-trackingpatch
https://github.com/chenyme/grok2api/commit/7ad0f7…	patch
https://github.com/chenyme/grok2api/releases/tag/v3.1.7	patch
https://github.com/chenyme/grok2api/	product

Impacted products

1 product

Vendor	Product	Version
chenyme	grok2api	Affected: 3.1.0 Affected: 3.1.1 Affected: 3.1.2 Affected: 3.1.3 Affected: 3.1.4 Affected: 3.1.5 Affected: 3.1.6 Unaffected: 3.1.7 cpe:2.3:a:chenyme:grok2api::::::::

Credits

carfeii (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "STT Billing"
          ],
          "product": "grok2api",
          "vendor": "chenyme",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.1.1"
            },
            {
              "status": "affected",
              "version": "3.1.2"
            },
            {
              "status": "affected",
              "version": "3.1.3"
            },
            {
              "status": "affected",
              "version": "3.1.4"
            },
            {
              "status": "affected",
              "version": "3.1.5"
            },
            {
              "status": "affected",
              "version": "3.1.6"
            },
            {
              "status": "unaffected",
              "version": "3.1.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "carfeii (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-841",
              "description": "Enforcement of Behavioral Workflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-840",
              "description": "Business Logic Errors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:15:17.807Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-431934 | chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/431934"
        },
        {
          "name": "VDB-431934 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/431934/cti"
        },
        {
          "name": "CVE-2026-123788 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-123788"
        },
        {
          "name": "Submit #1033606 | https://github.com/chenyme/ grok2api v3.1.6 Improper Enforcement of Behavioral Workflow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1033606"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/chenyme/grok2api/issues/1072"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/pull/1073"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/chenyme/grok2api/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-06T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-06T15:49:41.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-123788",
    "datePublished": "2026-11-06T21:15:17.807Z",
    "dateReserved": "2026-11-06T14:44:36.840Z",
    "dateUpdated": "2026-11-06T21:15:17.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123748 (GCVE-0-2026-123748)

Vulnerability from cvelistv5 – Published: 2026-11-06 17:15 – Updated: 2026-11-06 17:15 X_Open Source

Title

chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption

Summary

A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

CWE

CWE-400 - Resource Consumption
CWE-404 - Denial of Service

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3824 records in the last 180 days details

References

9 references

URL	Tags
https://vuldb.com/vuln/431905	vdb-entrytechnical-description
https://vuldb.com/vuln/431905/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-123748	third-party-advisory
https://vuldb.com/submit/1033605	third-party-advisory
https://github.com/chenyme/grok2api/issues/1071	issue-tracking
https://github.com/chenyme/grok2api/pull/1073	issue-trackingpatch
https://github.com/chenyme/grok2api/commit/7ad0f7…	patch
https://github.com/chenyme/grok2api/releases/tag/v3.1.7	patch
https://github.com/chenyme/grok2api/	product

Impacted products

1 product

Vendor	Product	Version
chenyme	grok2api	Affected: 3.1.0 Affected: 3.1.1 Affected: 3.1.2 Affected: 3.1.3 Affected: 3.1.4 Affected: 3.1.5 Affected: 3.1.6 Unaffected: 3.1.7 cpe:2.3:a:chenyme:grok2api::::::::

Credits

carfeii (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "WebSocket Proxy"
          ],
          "product": "grok2api",
          "vendor": "chenyme",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.1.1"
            },
            {
              "status": "affected",
              "version": "3.1.2"
            },
            {
              "status": "affected",
              "version": "3.1.3"
            },
            {
              "status": "affected",
              "version": "3.1.4"
            },
            {
              "status": "affected",
              "version": "3.1.5"
            },
            {
              "status": "affected",
              "version": "3.1.6"
            },
            {
              "status": "unaffected",
              "version": "3.1.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "carfeii (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T17:15:20.058Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-431905 | chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/431905"
        },
        {
          "name": "VDB-431905 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/431905/cti"
        },
        {
          "name": "CVE-2026-123748 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-123748"
        },
        {
          "name": "Submit #1033605 | https://github.com/chenyme/ grok2api v3.1.6 Uncontrolled Resource Consumption",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1033605"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/chenyme/grok2api/issues/1071"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/pull/1073"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/chenyme/grok2api/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-06T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-06T14:03:40.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-123748",
    "datePublished": "2026-11-06T17:15:20.058Z",
    "dateReserved": "2026-11-06T12:58:35.166Z",
    "dateUpdated": "2026-11-06T17:15:20.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities by chenyme

CVE-2026-124574 (GCVE-0-2026-124574)

CVE-2026-123788 (GCVE-0-2026-123788)

CVE-2026-123748 (GCVE-0-2026-123748)

CVE-2026-124574 (GCVE-0-2026-124574)

CVE-2026-123788 (GCVE-0-2026-123788)

CVE-2026-123748 (GCVE-0-2026-123748)