sim

Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.

1. SimStudioAI sim route.ts handleLocalFile path traversalCVE-2025-7107SimStudioAI · CVSS 5.3 · 0.9% likely

   CWE-22

2. SimStudioAI sim route.ts code injectionCVE-2025-10097SimStudioAI · CVSS 6.3 · 0.8% likely

   CWE-94

3. simstudioai sim CRON Secret internal.ts improper authenticationCVE-2025-15099simstudioai · CVSS 7.3 · 0.8% likely

   CWE-287

4. SimStudioAI sim path traversalCVE-2025-9801SimStudioAI · CVSS 5.4 · 0.8% likely

   CWE-22

5. SimStudioAI sim Session route.ts POST missing authenticationCVE-2025-7114SimStudioAI · CVSS 7.3 · 0.6% likely

   CWE-306

6. Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ PathCVE-2026-86115simstudioai · CVSS 5 · 0.5% likely

   CWE-441

7. Sim Studio AI - MongoDB SSRF and Arbitrary Document DeletionCVE-2026-3431SimStudioAI · CVSS 9.8 · 0.4% likely

   CWE-862

8. Sim Studio AI - Unauthenticated OAuth Token TheftCVE-2026-3432SimStudioAI · CVSS 9.3 · 0.3% likely

   CWE-862

9. SimStudioAI sim HTML File route.ts import unrestricted uploadCVE-2025-9800SimStudioAI · CVSS 6.3 · 0.3% likely

   CWE-434

10. SimStudioAI sim Password Protection deployment.ts weak hashCVE-2026-13510SimStudioAI · CVSS 3.7 · 0.3% likely

    CWE-328

11. SimStudioAI sim route.ts server-side request forgeryCVE-2025-9805SimStudioAI · CVSS 6.3 · 0.3% likely

    CWE-918

12. SimStudioAI sim route.ts server-side request forgeryCVE-2025-10096SimStudioAI · CVSS 6.3 · 0.3% likely

    CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.