PyPIPackage

openviking

3 known vulnerabilities (1 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-40525
Affects 0.2.10.dev45 to 0.3.8 (0.3.9 is outside it)
CVE-2026-22680
Affects 0.2.10.dev45 to 0.3.2 (0.3.3 is outside it)
CVE-2026-28518
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-40525Critical 9.1
OpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI
Affected: fixed in 0.3.9; fixed in 0.3.9.
Fixed in 0.3.9 (released Apr 18, 2026, 1 day after disclosure).
The latest release, 0.5.3, is not affected.
CVE-2026-22680Medium 6.9
OpenViking < 0.3.3 Missing Authorization via Task Polling
Affected: fixed in 0.3.3; fixed in 0.3.3.
Fixed in 0.3.3 (released Apr 3, 2026, 4 days before disclosure).
The latest release, 0.5.3, is not affected.
CVE-2026-28518High 8.4
OpenViking .ovpack Import ZIP Slip Path Traversal
Affected: through 0.2.1; through 0.2.1.
Fixed in 0.2.11 (released Mar 25, 2026, 22 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.5.3, is not affected.