refly vulnerabilities
CVEs whose affected-version data names the refly package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-101052High· 7.3PoCA security vulnerability has been detected in refly-ai refly up to 1.1.0
A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the inpu…
▾ Midnightrefly-ai · reflyEPSS 0.28%via NVD
CVE-2026-91199Medium· 5.0Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address
Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make th…
▾ Sunlitrefly-ai · reflyEPSS 0.34%via NVD