Verba vulnerabilities
CVEs whose affected-version data names the Verba package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-65317High· 8.6PoCVerba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by suppl…
▾ MidnightWeaviate · VerbaEPSS 0.64%via CVEORG
CVE-2026-65318High· 8.6PoCVerba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled UR…
▾ MidnightWeaviate · VerbaEPSS 0.60%via CVEORG