59129 matches found
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: glib2 (UTSA-2026-016789)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016789 advisory. A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform pat...
CVE-2026-42213
creationtimestamp| type| source ---|---|--- 2026-05-08 23:24:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleuu7yjok2o...
CVE-2026-42298
creationtimestamp| type| source ---|---|--- 2026-05-08 23:24:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mleuu5h24l2e 2026-05-09 01:13:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlf2wfsfch2p 2026-05-09 03:00:31+00:00| seen|...
CVE-2026-42354
creationtimestamp| type| source ---|---|--- 2026-05-08 23:22:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mleupkgzli2z 2026-05-09 00:00:40+00:00| seen| https://infosec.exchange/users/offseq/statuses/116541675237436780 2026-05-09 00:00:42+00:00| seen|...
CVE-2026-25199
creationtimestamp| type| source ---|---|--- 2026-05-08 22:29:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlerqoxyid2w 2026-05-09 05:01:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlfhn5uh3l2v...
CVE-2026-42193
creationtimestamp| type| source ---|---|--- 2026-05-08 22:28:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlerpeba2u2n 2026-05-08 22:36:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mles67hmih2p 2026-05-09 07:30:30+00:00| seen|...
CVE-2026-42287
Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been...
CVE-2026-42291 SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional
SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and creating sharing links for personal notes is not properly authorized. This allows authenticated attackers who obtain the note ID of victim users to list and...
CVE-2026-42287
Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been...
EUVD-2026-28842
Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been...
CVE-2026-32743
creationtimestamp| type| source ---|---|--- 2026-05-08 21:00:04+00:00| seen| Telegram/L06xv0vmv9B-lUjnDANUtY1-6vQFMFDzrcYuiA5m0MAZkY 2026-06-11 18:40:48+00:00| seen| https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3mnzuth3bkmi2 2026-06-11 19:45:32+00:00| see...
Missing Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the basemodelid process. An attacker can gain unauthorized access to restricted models by creating a new model that chains to a restricted base model and invoking it, causing the serv...
GHSA-9VVH-QMJX-P4Q8 Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
Base Model Routing Bypasses Access Control via Model Chaining Affected Component Model chaining via basemodelid: - backend/openwebui/routers/models.py lines 170-214, createnewmodel - backend/openwebui/routers/models.py lines 254-308, importmodels - backend/openwebui/main.py lines 1696-1711, base...
GHSA-HR43-RJMR-7WMM Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts Affected Component Folder creation endpoint and form model: - backend/openwebui/models/folders.py lines 72-77, FolderForm with extra='allow' - backend/openwebui/models/folders.py lines 95-106,...
Missing Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization via the createfolder process. An attacker can create unauthorized folders in another user's account, potentially flooding the victim's folder tree or planting phishing content, by...
Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts Affected Component Folder creation endpoint and form model: - backend/openwebui/models/folders.py lines 72-77, FolderForm with extra='allow' - backend/openwebui/models/folders.py lines 95-106,...
CVE-2026-42180 Lemmy: SSRF in /api/v3/post via Webmention dispatch
Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controll...
CVE-2026-42180 Lemmy: SSRF in /api/v3/post via Webmention dispatch
Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controll...
CVE-2026-42180
Lemmy prior to version 0.19.18 is affected by a server-side request forgery: an authenticated low-privilege user can create a link post via POST /api/v3/post, and when posted to public communities Lemmy dispatches a Webmention to the target. The code path only validates the URL’s syntax/scheme (h...