Helicone has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 6.0 (medium).

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 6.0
Publish → KEV: —
Last 90 days: 2 prev 0

Weakness classes

Products

helicone 2

Follow Helicone:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

CVE-2026-85178High· 7.7Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier54
CVE-2026-108602Medium· 4.3Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses24

Helicone vulnerabilities

CVEs affecting Helicone, newest first. Open any entry for full detail, references, and exploit status.

2 CVEsRSS

CVE-2026-108602Medium· 4.3

2w ago

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Att…

▾ SunlitHelicone · heliconeEPSS 0.21%via NVD

CVE-2026-85178High· 7.7PoC

1mo ago

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owne…

▾ MidnightHelicone · heliconeEPSS 0.41%via NVD