19014 matches found
CVE-2026-87012 Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/openwebui/models/calendar.py stored the calendar event meta.alertminutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An...
PT-2026-89159
Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value Summary Calendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object ...
CVE-2026-86853
creationtimestamp| type| source ---|---|--- 2026-09-08 20:15:23+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86853 2026-09-09 13:50:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mv3okv6hgh2l...
CVE-2026-86736
creationtimestamp| type| source ---|---|--- 2026-09-08 20:15:16+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86736...
CVE-2026-86737
creationtimestamp| type| source ---|---|--- 2026-09-08 20:15:11+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86737...
CVE-2026-86734
creationtimestamp| type| source ---|---|--- 2026-09-08 20:15:02+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86734...
CVE-2026-86732
creationtimestamp| type| source ---|---|--- 2026-09-08 17:01:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muzirvtrwu2o 2026-09-08 17:52:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/a3rrx67pj2usq 2026-09-08 20:15:07+00:00| seen|...
CVE-2026-86738
creationtimestamp| type| source ---|---|--- 2026-09-08 17:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muzirohpay2s 2026-09-08 17:58:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5cxtp2tqqrxtz 2026-09-08 18:08:22+00:00| seen|...
CVE-2026-86267
creationtimestamp| type| source ---|---|--- 2026-09-07 08:15:12+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86267...
CVE-2026-86265
creationtimestamp| type| source ---|---|--- 2026-09-07 08:15:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86265...
CVE-2026-86268
creationtimestamp| type| source ---|---|--- 2026-09-07 05:47:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2zui7f45fntkc 2026-09-07 08:15:10+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86268...
CVE-2026-86269
creationtimestamp| type| source ---|---|--- 2026-09-07 05:41:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2ry6clra3wtkl 2026-09-07 08:15:07+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86269...
CVE-2026-86315
creationtimestamp| type| source ---|---|--- 2026-09-07 05:35:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/g4og66twpugy6 2026-09-07 08:15:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-86315...
CVE-2026-86426: Improper Authentication
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...
EUVD-2026-71777
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-86090 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-86090
ntopng before 6.7.260717 fails to perform authorization checks in the REST v2 delete handlers for notification endpoints and recipients (in endpoints.lua and recipients.lua). An authenticated non-administrator user can issue POST requests to irreversibly delete all configured notification endpoin...
CVE-2026-86090 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-85650
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...