serge-chat vulnerabilities

Products

• serge 1
• serge-chat/serge 1

Latest serge-chat CVEs

Newest publication first

1. CVE-2026-6588 serge-chat serge Model API Endpoint model.py delete_model missing authentication

   Published 2026-04-20

   Medium·CVSS 6.9 EPSS 0.43%

   A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/routers/model.py of the component Model API Endpoint. Executing a manipulation can lead to missing authentication. The attack...

2. CVE-2024-11441 Stored XSS in Serge in serge-chat/serge

   Published 2025-03-20

   Medium·CVSS 6.1 EPSS 0.40%

   A stored cross-site scripting (XSS) vulnerability exists in Serge version 0.9.0. The vulnerability is due to improper neutralization of input during web page generation in the chat prompt. An attacker can exploit this vulnerability by sending a crafted message containing maliciou...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.