Skip to content

Product

usefathom/fathom vulnerabilities

2 published CVES affecting usefathom/fathom, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest usefathom/fathom CVEs

Newest publication first

  1. CVE-2026-65698 Void 1.3.4 Path Traversal via AI Agent File-Reading Tools

    Published
    MediumCVSS 6.0 EPSS 0.47%

    Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute p...

  2. CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

    Published
    MediumCVSS 5.1 EPSS 0.27%

    Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.