Vulnerabilities in The-40-Thieves
7 resultsCVE-2026-115477HIGHobsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTPEPSS 0.4%CVE-2026-115478HIGHobsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesEPSS 0.3%CVE-2026-77366CRITICALobsidian-tc tokens can access arbitrary configured vaultsEPSS 0.3%CVE-2026-77364MEDIUMobsidian-tc fail-open default ACL exposes Obsidian control-directory secretsEPSS 0.2%CVE-2026-77362MEDIUMobsidian-tc bridge tools expose data outside the read ACLEPSS 0.2%CVE-2026-77363HIGHobsidian-tc Streamable HTTP transport permits cross-origin loopback vault accessEPSS 0.2%CVE-2026-77361MEDIUMobsidian-tc symlink path mismatch bypasses read ACL restrictionsEPSS 0.1%