serena vulnerabilities
CVEs whose affected-version data names the serena package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-109965High· 7.1PoCSerena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically wit…
▾ Midnightoraios · serenaEPSS 0.22%via NVD
CVE-2026-38924Low· 2.9PoCIn Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report prop…
▾ TwilightOraios AI · SerenaEPSS 0.16%via NVD