10647 matches found
CVE-2024-8060
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...
CVE-2021-41089 vulnerabilities
Vulnerabilities for packages: docker...
GHSA-V994-F8VW-G7J4 vulnerabilities
Vulnerabilities for packages: docker...
GHSA-V994-F8VW-G7J4 vulnerabilities
Vulnerabilities for packages: docker...
CVE-2021-41089 vulnerabilities
Vulnerabilities for packages: docker...
Unintended Secret Exposure
github.com/docker/buildx is vulnerable to unintended secret exposure. The vulnerability is due to improper handling of sensitive data in OpenTelemetry traces and BuildKit daemon's history records, that allows an attacker to access sensitive secrets by extracting them...
Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...
GHSA-FF5C-56M7-VC75 Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...
CVE-2024-13060
A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1...
CVE-2024-13060 Improper Authorization in mintplex-labs/anything-llm
A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1...
CVE-2024-13060 Improper Authorization in mintplex-labs/anything-llm
A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1...
CVE-2024-13060 Improper Authorization in mintplex-labs/anything-llm
A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1...
CVE-2024-13060
CVE-2024-13060 affects AnythingLLM Docker 1.3.1 and earlier. Affected component: the user cookie handling (cookie parameter id) that determines which profile picture is loaded. Root cause: insufficient authorization checks allow users with Default permission to access other users’ profile picture...
CVE-2025-0495 vulnerabilities
Vulnerabilities for packages: kubescape, docker-compose...
GHSA-M4GQ-FM9H-8Q75 vulnerabilities
Vulnerabilities for packages: kubescape, docker-compose...
CVE-2024-40635 vulnerabilities
Vulnerabilities for packages: dagger, k3s, syft, kubevela, fuse-overlayfs-snapshotter, kubescape, opa-envoy, buildkitd, envoy-gateway, nerdctl, spegel, rancher-fleet, helm-push, kots, kaniko, skaffold, chartmuseum, xeol, docker-cli-buildx, k8sgpt, docker-compose, helm-operator, cert-manager-cmctl...
GHSA-265R-HFXG-FHMG vulnerabilities
Vulnerabilities for packages: dagger, k3s, syft, kubevela, fuse-overlayfs-snapshotter, kubescape, opa-envoy, buildkitd, envoy-gateway, nerdctl, spegel, rancher-fleet, helm-push, kots, kaniko, skaffold, chartmuseum, xeol, docker-cli-buildx, k8sgpt, docker-compose, helm-operator, cert-manager-cmctl...
PT-2025-12191 · Mintplex · Anything-Llm
Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm version 1d9452da2b92 Description: A denial of service issue arises when uploading an audio file with a very low sample rate, causing the site instance to crash. This occurs due to the localWhisper implementation,...
CVE-2025-0495
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry...