Cognition vulnerabilities

CVEs whose affected-version data names the Cognition package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-109437Critical· 9.8

today

Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via…

▾ MidnightCognicellAI · Cognitionvia CVEORG