PT-2026-132350

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where clamp untrusted fails to cap the delay before return html, mean delay, and max range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stre...

UncleCode Crawl4AI resource management error vulnerability

UncleCode Crawl4AI versions prior to 0.9.5 contain a resource management error vulnerability. This flaw arises because in the Docker API server, clampuntrusted fails to restrict the delaybeforereturnhtml, meandelay, and maxrange fields within untrusted CrawlerRunConfig requests. Unauthenticated...

UncleCode Crawl4AI code injection vulnerability

UncleCode Crawl4AI versions prior to 0.9.0 through 0.9.5 contain a code injection vulnerability. This flaw stems from improper handling of the cssselector and waitfor fields by the Docker API server. Attackers can inject quotes or js: conditions to bypass the jscode block, allowing authenticated...

PT-2026-132352

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css selector and wait for fields. Attackers can inject quotes into css selector or supply js:...

PT-2026-132394

Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.18.0 Description The API server fails to authorize callers when retrieving logs via the 'GET /apis/v1alpha1/runs/run id/nodes/node id/log' endpoint. An attacker with backend access who knows a victim run ...

PT-2026-132396

Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.18.0 Description The API server decompresses uploaded pipeline archives without properly bounding the expanded data during the process of locating or reading the pipeline file. This can allow a small ZIP ...

CVE-2026-116108

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...

CVE-2026-116108 openbq-org OpenBB Local API Server api_settings.py access control

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...

EUVD-2026-109600

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...

CVE-2026-116108 openbq-org OpenBB Local API Server api_settings.py access control

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...

CVE-2026-116108

A flaw in openbq-org OpenBB (versions up to 4.7.2/5.0.0 ) affects the Local API Server component. The vulnerability exists within the file openbb_platform/core/openbb_core/app/model/api_settings.py, where a flaw leads to improper access controls . This issue allows for remote exploitation , and t...

CVE-2026-116108

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...

OpenBB permission and access control issue vulnerability

OpenBB versions 4.7.2 and earlier, as well as 5.0.0 and earlier, contain a permission and access control vulnerability. This vulnerability stems from improper access control in the file openbbplatform/core/openbbcore/app/model/apisettings.py within the Local API Server component, potentially...

Huangxd LogVar Streaming API Server Authorization Issue Vulnerability

Versions of the huangxd LogVar stream API server prior to 1.21.7 contain an authorization issue vulnerability. This vulnerability arises from authentication bypass when using a default TOKEN without setting ADMINTOKEN. Unauthenticated attackers can modify the server’s environment configuration by...

PT-2026-123154

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb platform/core/openbb core/app/model/api settings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Th...

CVE-2026-116179

A flaw was found in vLLM. A remote attacker can cause a Denial of Service DoS by sending a specially crafted request containing an inline video that bypasses frame-count limits. By overriding media decoding parameters, the attacker forces the service to decode every frame of an oversized video...

CVE-2026-115508

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via...

CVE-2026-115508 Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via...

CVE-2026-115508 Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via...

CVE-2026-115508

The Crawl4AI library (versions 0.7.0 before 0.9.5 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) via the /crawl request body. The root cause is inefficient regular expression complexity, which allows authenticated API clients to supply unbounded regular expressions in fields su...