What’s Vulnerable › Products
The-40-Thieves obsidian-tc vulnerabilities
7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.
Check whether your The-40-Thieves obsidian-tc version is affected
Latest The-40-Thieves obsidian-tc vulnerabilities
- CVE-2026-115478 — obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes (CVSS 7.1)
- CVE-2026-115477 — obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP (CVSS 7.1)
- CVE-2026-77362 — obsidian-tc bridge tools expose data outside the read ACL (CVSS 4.3)
- CVE-2026-77361 — obsidian-tc symlink path mismatch bypasses read ACL restrictions (CVSS 4.7)
- CVE-2026-77366 — obsidian-tc tokens can access arbitrary configured vaults (CVSS 9.9)
- CVE-2026-77364 — obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets (CVSS 6.5)
- CVE-2026-77363 — obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access (CVSS 8.8)