PT-2026-41348

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Description An issue exists where the system fails to enforce the PostEditTimeLimit on non-message post fields. This allows an authenticated user to modify...

GHSA-H2CW-7QW9-56XR Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

Summary When setting model permissions so that a group has read access to it, intending for other users to use it, those users also can read the model's system prompt. However users may consider their system prompt confidential, so we consider this a security issue. Compare...

GHSA-GM54-M39W-GRJP Open WebUI missing authorization check at the model update function - models from other users can be updated

Summary A user can modify another user's model even if its visibility is set to Private. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the linkHref field handling. An attacker can execute arbitrary JavaScript by supplying a javascript: URL in an image widget's link URL field and having it rendered on the page. This affects...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the Object.assign process. An attacker can gain unauthorized access to and control over data across different workspaces by...

The vulnerability of the Rich Text Edit Control text editor in Windows operating systems, which allows attackers to exploit their privileges.

The vulnerability of the Rich Text Edit Control text editor in Windows operating systems is related to the repeated release of memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Rich Text Edit Control text editor in the Windows operating system, which allows attackers to exploit their privileges.

The vulnerability of the Rich Text Edit Control text editor in the Windows operating system is related to a memory reclamation error. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-45708

CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...

CVE-2026-32170

Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally...

CVE-2026-7619

The CVE-2026-7619 entry details an authenticated SQL Injection in the Charitable WordPress plugin (

CVE-2026-7619

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 1.8.10.4 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-29570

Double free in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally...

EUVD-2026-29547

Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally...

CVE-2026-21530

Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally...

CVE-2026-32170 Windows Rich Text Edit Elevation of Privilege Vulnerability

...

CVE-2026-32170 Windows Rich Text Edit Elevation of Privilege Vulnerability

...

CVE-2026-32170

Technical details for CVE-2026-32170 are not publicly available in the provided documents beyond the basic description. No vendor, product, version, root cause, impact, or fix specifics are supplied here. Monitor official disclosures and CVE/Microsoft update guidance for updates.

CVE-2026-21530 Windows Rich Text Edit Elevation of Privilege Vulnerability

...

CVE-2026-21530 Windows Rich Text Edit Elevation of Privilege Vulnerability

...

CVE-2026-21530

CVE-2026-21530 : A double-free vulnerability in Windows Rich Text Edit is described as enabling an authorized attacker to perform local privilege escalation. The connected documents confirm the affected component and the local-privilege-elevation impact but do not provide exploit details, specifi...