# Eosphoros-Ai vulnerabilities Source: https://junglewise.ai/threats/vendors/eosphoros-ai Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/eosphoros-ai.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in Eosphoros-Ai: 0 in the last 7 days and 10 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123019, was published on 5 November 2026. 5 vulnerabilities in the last four weeks, up 25% on the four before (4). 2 critical against 0. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 5 - Last 90 days: 10 - All time: 11 (3 critical, 0 exploited in the wild) ## Latest Eosphoros-Ai vulnerabilities - [CVE-2026-123019: eosphoros-ai DB-GPT remote code execution in HuggingFace adapter](https://junglewise.ai/threats/cve-2026-123019-a-weakness-has-been-identified-in-eosphoros-ai-db-gpt-up-to-0-8) (high, CVSS 7.3, published 5 Nov 2026) - [CVE-2026-123018: eosphoros-ai DB-GPT code injection in CodeAction](https://junglewise.ai/threats/cve-2026-123018-a-security-flaw-has-been-discovered-in-eosphoros-ai-db-gpt-up-to) (high, CVSS 8.3, published 5 Nov 2026) - [CVE-2026-51863: DB-GPT directory traversal in use_example_file](https://junglewise.ai/threats/cve-2026-51863-db-gpt-v0-7-5-and-0-8-0-contains-directory-traversal-in-use) (info, published 29 Oct 2026) - [CVE-2026-77933: DB-GPT hardcoded credentials in default Docker configuration](https://junglewise.ai/threats/cve-2026-77933-db-gpt-through-0-8-2-contains-a-hardcoded-credentials) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-77932: DB-GPT unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-77932-db-gpt-through-0-8-2-contains-an-unauthenticated-remote-code) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-51869: DB-GPT sandbox API fallback to LocalRuntime code execution](https://junglewise.ai/threats/cve-2026-51869-db-gpt-v0-8-0-sandbox-api-silently-falls-back-to-localruntime-and) (info, published 30 Sep 2026) - [CVE-2026-51866: DB-GPT code execution in skill manager](https://junglewise.ai/threats/cve-2026-51866-in-db-gpt-0-7-5-and-0-8-0-a-skill-uploaded-through-the-real-api) (info, published 30 Sep 2026) - [CVE-2026-51864: DB-GPT directory traversal in python_file_upload](https://junglewise.ai/threats/cve-2026-51864-db-gpt-v0-7-5-and-v0-8-0-contains-directory-traversal-in-python) (info, published 30 Sep 2026) - [CVE-2026-51862: DB-GPT directory traversal in skill_upload endpoint](https://junglewise.ai/threats/cve-2026-51862-db-gpt-0-8-0-contains-directory-traversal-in-skill-upload) (info, published 30 Sep 2026) - [CVE-2026-80104: DB-GPT path traversal in skill upload endpoint](https://junglewise.ai/threats/cve-2026-80104-db-gpt-path-traversal-in-skill-upload-endpoint) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2024-10906: PYSEC-2026-1289 - DB-GPT vulnerable to Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2024-10906-db-gpt-cross-site-request-forgery-via-permissive-cors) (low, CVSS 3.1, published 7 Jul 2026) ## Most severe Eosphoros-Ai vulnerabilities - [CVE-2026-80104: DB-GPT path traversal in skill upload endpoint](https://junglewise.ai/threats/cve-2026-80104-db-gpt-path-traversal-in-skill-upload-endpoint) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-77933: DB-GPT hardcoded credentials in default Docker configuration](https://junglewise.ai/threats/cve-2026-77933-db-gpt-through-0-8-2-contains-a-hardcoded-credentials) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-77932: DB-GPT unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-77932-db-gpt-through-0-8-2-contains-an-unauthenticated-remote-code) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-123018: eosphoros-ai DB-GPT code injection in CodeAction](https://junglewise.ai/threats/cve-2026-123018-a-security-flaw-has-been-discovered-in-eosphoros-ai-db-gpt-up-to) (high, CVSS 8.3, published 5 Nov 2026) - [CVE-2026-123019: eosphoros-ai DB-GPT remote code execution in HuggingFace adapter](https://junglewise.ai/threats/cve-2026-123019-a-weakness-has-been-identified-in-eosphoros-ai-db-gpt-up-to-0-8) (high, CVSS 7.3, published 5 Nov 2026) - [CVE-2024-10906: PYSEC-2026-1289 - DB-GPT vulnerable to Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2024-10906-db-gpt-cross-site-request-forgery-via-permissive-cors) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-51863: DB-GPT directory traversal in use_example_file](https://junglewise.ai/threats/cve-2026-51863-db-gpt-v0-7-5-and-0-8-0-contains-directory-traversal-in-use) (info, published 29 Oct 2026) - [CVE-2026-51869: DB-GPT sandbox API fallback to LocalRuntime code execution](https://junglewise.ai/threats/cve-2026-51869-db-gpt-v0-8-0-sandbox-api-silently-falls-back-to-localruntime-and) (info, published 30 Sep 2026) - [CVE-2026-51866: DB-GPT code execution in skill manager](https://junglewise.ai/threats/cve-2026-51866-in-db-gpt-0-7-5-and-0-8-0-a-skill-uploaded-through-the-real-api) (info, published 30 Sep 2026) - [CVE-2026-51864: DB-GPT directory traversal in python_file_upload](https://junglewise.ai/threats/cve-2026-51864-db-gpt-v0-7-5-and-v0-8-0-contains-directory-traversal-in-python) (info, published 30 Sep 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up 25% on the four before (4). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 1 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 4 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 2 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Eosphoros-Ai technologies - [Eosphoros-Ai DB-GPT](https://junglewise.ai/threats/technologies/db-gpt): 11 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Eosphoros-Ai vulnerabilities", https://junglewise.ai/threats/vendors/eosphoros-ai, 13 November 2026.