dragonflyoss dragonfly vulnerabilities

CVEs per yearBy the year they were published

1. 202511
2. 20263

Newest CVEs

• CVE-2026-49254

  Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

  dragonflyoss · dragonfly

  Low2.9
• CVE-2026-54637

  Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

  dragonflyoss · dragonfly

  Medium5.5
• CVE-2026-24124

  Dragonfly Manager Job API Allows Unauthenticated Access

  dragonflyoss · dragonfly

  High8.9
• CVE-2025-59410

  Dragonfly tiny file download uses hard coded HTTP protocol

  dragonflyoss · dragonfly

  Medium5.5
• CVE-2025-59354

  Dragonfly has weak integrity checks for downloaded files

  dragonflyoss · dragonfly

  Medium5.5
• CVE-2025-59353

  Manager generates mTLS certificates for arbitrary IP addresses

  dragonflyoss · dragonfly

  High7.7
• CVE-2025-59352

  Dragonfly allows arbitrary file read and write on a peer machine

  dragonflyoss · dragonfly

  Medium6.9
• CVE-2025-59351

  Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error

  dragonflyoss · dragonfly

  Low2.7
• CVE-2025-59350

  Timing attacks against Proxy’s basic authentication are possible

  dragonflyoss · dragonfly

  Low2.7
• CVE-2025-59349

  Directories created via os.MkdirAll are not checked for permissions

  dragonflyoss · dragonfly

  Low2.0