Chroma vulnerabilities
Every vulnerability this feed holds for Chroma, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
3 vulnerabilities tracked. 1 with public exploit code.
- 9.4 A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary…
- 8.8 The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a…
- 8.8 A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Chroma is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Microsoft Google Red Hat n/a Apache Software Foundation MediaTek, Inc. Linux Apple Gitea WAVLINK Dell vim Eclipse Foundation jpadilla Huawei WSO2 Unknown py-pdf vercel nodejs PostgreSQL Control Web Panel aws Hewlett Packard Enterprise (HPE)