1 CRIT · 9 HIGH · 1 MED · 1 INFO · THREAT RED · 12 items · Generated in 233s
Unauthenticated attackers can upload a malicious pickle and get remote code execution on the ComfyUI host.
Anyone on the network can invoke MCP tools without auth and use the server's Dynatrace rights to read data or create content.
Untrusted input is executed in workflow templates, enabling persistent data exfiltration from Dynatrace workflows.
Unauthenticated attackers can read arbitrary image-format files from the host via crafted workflows and exposed view endpoints.
Unauthenticated path traversal can expose image-readable files and leak host paths, aiding further compromise.
Attackers can bypass intended query limits and run arbitrary DQL stages through trusted tool parameters.
Stored XSS in ComfyUI can steal API tokens and let attackers make same-origin authenticated API calls.
Stored XSS in ComfyUI can run attacker code in a user's browser and compromise sessions or actions in the app origin.
Shows AI-assisted bug finding in major software, but the item gives no exploit details, affected versions, or patch guidance.
Shows an AI agent was used to find targets and choose exploits with little operator input, lowering effort for scalable attacks.
Shows AI being used to scale vulnerability discovery and speed attacker operations across multiple targets.
Component trust gaps in AI tooling can open attack paths across the stack, raising risk even without a specific exploit named.