NPM: SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

NPM: SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl vulnerability discovered by ? in WordPress Npm sillytavern versions = 1.17.0...

SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

Resolution SillyTavern 1.18.0 added a generic server-side request filter Private Request Whitelisting. Since we expect users to use the application in a trusted environment, the filter is disabled by default, however it is strongly advised to be enabled and properly configured when an instance is...

Server-side Request Forgery (SSRF)

Overview sillytavern is a LLM Frontend for Power Users Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in SearXNG search proxy via unvalidated baseUrl. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive th...

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Summary pymdownx.snippets has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With restrictbasepath: True the default, the current filename.startswithbase containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling...

GHSA-62Q4-447F-WV8H Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Summary pymdownx.snippets has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With restrictbasepath: True the default, the current filename.startswithbase containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling...

MAL-2026-4769 Malicious code in soundsource (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3285c5fec24c01c9c463e85c199934f5a08da7e94277583430a6e3feb274add The package's source distribution contains Token.txt at the tarball root holding a live PyPI API token prefix pypi-AgEIcHlwaS5vcmc.... Anyone who...

Malicious code in soundsource (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3285c5fec24c01c9c463e85c199934f5a08da7e94277583430a6e3feb274add The package's source distribution contains Token.txt at the tarball root holding a live PyPI API token prefix pypi-AgEIcHlwaS5vcmc.... Anyone who...

Important: Red Hat Security Advisory: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

EUVD-2026-30966

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object rather than a String to Faraday::Connectionbuildexclusiveurl. This...

Important: Red Hat Security Advisory: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

An update for multiple packages is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

com.vaadin:com.vaadin.gradle.plugin (>=23.0.0, <=23.6.9), com.vaadin:flow-gradle-plugin (>=23.0.0, <=23.6.10) +12 more potentially affected by CVE-2026-7860 via com.vaadin:flow-plugin-base (>=23.0.0, <=23.6.10)

com.vaadin:flow-plugin-base MAVEN version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =0.0.2-8-605ce6, =0.0.2-8-605ce6, =0.0.0-24-fcfa64, =0.0.0, =1.4.0-m2, =1.4.0-m2, =2.0.0-m1 - org.geckoprojects.vaadin:org.gecko.vaadin.generator 2.0.0 Source cves: CVE-2026-7860 Source advisory:...

com.github.mcollovati:quarkus-hilla-commons-deployment (>=24.7.0, <=24.9.5), com.github.mcollovati:quarkus-hilla-deployment (>=24.7.0, <=24.9.5) +18 more potentially affected by CVE-2026-7860 via com.vaadin:flow-plugin-base (>=24.0.0, <=24.9.17)

com.vaadin:flow-plugin-base MAVEN version =24.0.0, =24.7.0, =24.7.0, =24.7.0, =24.8.0, =24.4.0, =24.0.0, =24.4.0, =24.0.0, =24.0.0, =24.0.0, =24.4.21, =24.4.0, =24.4.0, =24.0.0, =24.0.0, =24.9.16 and more Source cves: CVE-2026-7860 Source advisory: SNYK:JAVA-COMVAADIN-17176894...

com.vaadin.flow:com.vaadin.flow.gradle.plugin (>=24.10.0-beta1, <=24.10.3), com.vaadin.hilla:com.vaadin.hilla.gradle.plugin (>=24.10.0-beta1, <=24.10.3) +9 more potentially affected by CVE-2026-7860 via com.vaadin:flow-plugin-base (>=24.10.0-beta1, <=24.10.3)

com.vaadin:flow-plugin-base MAVEN version =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.0-beta1, =24.10.3 Source cves: CVE-2026-7860 Source advisory:...

com.github.mcollovati:quarkus-hilla-commons-deployment (>=25.0.0-alpha1, <=25.0.1), com.github.mcollovati:quarkus-hilla-deployment (>=25.0.0-alpha1, <=25.0.1) +14 more potentially affected by CVE-2026-7860 via com.vaadin:flow-plugin-base (>=25.0.0-beta1, <=25.0.11)

com.vaadin:flow-plugin-base MAVEN version =25.0.0-beta1, =25.0.0-alpha1, =25.0.0-alpha1, =25.0.0-alpha1, =25.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =25.0.0-beta1, =3.0.0-beta1, =3.0.3 and mo...

com.github.mcollovati:quarkus-hilla-commons-deployment (>=25.1.0-alpha1, <=25.1.0), com.github.mcollovati:quarkus-hilla-deployment (>=25.1.0-alpha1, <=25.1.0) +14 more potentially affected by CVE-2026-7860 via com.vaadin:flow-plugin-base (>=25.1.0-beta1, <=25.1.4)

com.vaadin:flow-plugin-base MAVEN version =25.1.0-beta1, =25.1.0-alpha1, =25.1.0-alpha1, =25.1.0-alpha1, =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =25.1.0-beta1, =3.1.0-beta1, =3.1.1 and mo...

com.github.mcollovati:quarkus-hilla-commons-deployment (>=24.7.0, <=24.9.6), com.github.mcollovati:quarkus-hilla-deployment (>=24.7.0, <=24.9.6) +18 more potentially affected by CVE-2026-7860 via com.vaadin:flow-plugin-base (>=24.0.0, <=24.10.3)

com.vaadin:flow-plugin-base MAVEN version =24.0.0, =24.7.0, =24.7.0, =24.7.0, =24.8.0, =24.4.0, =24.0.0, =24.4.0, =24.0.0, =24.0.0, =24.0.0, =24.4.21, =24.4.0, =24.4.0, =24.0.0, =24.0.0, =24.10.3 and more Source cves: CVE-2026-7860 Source advisory: MEND:CVE-2026-7860...

com.github.mcollovati:quarkus-hilla-commons-deployment (>=25.0.0-rc1, <=25.1.0), com.github.mcollovati:quarkus-hilla-deployment (>=25.0.0-rc1, <=25.1.0) +15 more potentially affected by CVE-2026-7860 via com.vaadin:flow-plugin-base (>=25.0.0, <=25.1.4)

com.vaadin:flow-plugin-base MAVEN version =25.0.0, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.1.4 and more Source cves: CVE-2026-7860 Source advisory: MEND:CVE-2026-7860...

com.vaadin:com.vaadin.gradle.plugin (>=23.0.0, <=23.6.9), com.vaadin:flow-gradle-plugin (>=23.0.0, <=23.6.10) +12 more potentially affected by CVE-2026-7860 via com.vaadin:flow-plugin-base (>=23.0.0, <=23.6.10)

com.vaadin:flow-plugin-base MAVEN version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =0.0.2-8-605ce6, =0.0.2-8-605ce6, =0.0.0-24-fcfa64, =0.0.0, =1.4.0-m2, =1.4.0-m2, =2.0.0-m1 - org.geckoprojects.vaadin:org.gecko.vaadin.generator 2.0.0 Source cves: CVE-2026-7860 Source advisory:...

Security update for postgresql15

This update for postgresql15 fixes the following issues Update to version 15.18. Security issues: CVE-2026-6472: ensure the user has CREATE privilege on the schema specified bsc1265172. CVE-2026-6473: integer overflows in memory-allocation calculations bsc1265173. CVE-2026-6474: Guard against...

CVE-2026-45402

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied fileid and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the...