GCD AI RADAR
products/weaviate

Weaviate

Filed as: Weaviate OSS

Records
5
Disclosed CVEs
5
Exploited (sev 3–4)
0
CISA KEV flagged
0

Newest record 2026-07-02 · 5 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for Weaviate has confirmed exploitation or a KEV flag.

Disclosures by month · last 24 months

Nov ’244 disclosed · peak 2 in Dec ’25Oct ’26

Disclosed CVEs, no confirmed exploitation · 5

  1. 2026-07-02
    CVE-2026-59093
    Weaviate RBAC Role Assignment Permission Verification Vulnerability
    2 Disclosedrbac · vector-database
    record AIR-2026-1150NVD ↗
  2. 2026-06-08
    CVE-2026-11500
    CVE-2026-11500: Weaviate Authorization Bypass in Static API Key Handler
    2 Disclosedauth_bypass
    record AIR-2026-1102NVD ↗
  3. 2025-12-12
    CVE-2025-67819
    CVE-2025-67819: Weaviate Arbitrary File Read Vulnerability
    2 Disclosedinfra_vuln
    record AIR-2025-0037NVD ↗
  4. 2025-12-12
    CVE-2025-67818
    CVE-2025-67818: Weaviate Directory Traversal Backup Vulnerability
    2 Disclosedinfra_vuln
    record AIR-2025-0036NVD ↗
  5. 2023-08-21
    CVE-2023-38976
    CVE-2023-38976: Weaviate Denial of Service Vulnerability
    2 Disclosedweaviate · dos
    record AIR-2023-0084NVD ↗

This page lists what has been reported, not what to do about it. Versions and fixes are in each linked advisory; check the vendor’s own advisory before acting.