CVE-2026-50162

A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link symlink traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside...

GHSA-Q79H-67VX-M9XG Decidim: CSV census record endpoints improper authorization

Description A participant manager can access and modify the CSV census record admin forms. Technical description The CSV census admin record-management surface under /admin/csvcensus/censuslogs does not enforce admin-only authorization before rendering or mutating Decidim::Verifications::CsvDatum...

GHSA-RWCV-WHM8-FMXM

creationtimestamp| type| source ---|---|--- 2026-07-13 17:11:49+00:00| seen| https://gist.github.com/alon710/1cf437e22a892172012205a9b0e24d57...

PYSEC-2026-2566 Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

Summary Langflow is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw...

PYSEC-2026-2633 mem0 server lacks authentication and authorization controls for its memory creation API endpoint

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint POST /memories. The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending...

PYSEC-2026-2654 MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

A vulnerability in the createmodelversion handler of mlflow/server/handlers.py in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a CreateModelVersion request includes the tag...

PYSEC-2026-2725 open-webui Vulnerable to Stored XSS via Model Description

!IMPORTANT Relationship to CVE-2024-7990 CVE-2024-7990 issued by huntr.dev, March 2025 describes a stored XSS in the same field — the model description — but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder...

PYSEC-2026-2719 Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Base Model Routing Bypasses Access Control via Model Chaining Affected Component Model chaining via basemodelid: - backend/openwebui/routers/models.py lines 170-214, createnewmodel - backend/openwebui/routers/models.py lines 254-308, importmodels - backend/openwebui/main.py lines 1696-1711, base...

PYSEC-2026-2893 PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image

Summary The markdowntabletoimage tool accepts a caller-controlled path parameter and passes it directly to gethtmltableimage: python pptagent/mcpserver.py:127-143 def markdowntabletoimagemarkdowntable: str, path: str, css: str - str: """ Args: path str: The file path where the image will be saved...

PYSEC-2026-2568 Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function createproject/encryptauthsettings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument authsetting...

PYSEC-2026-3058 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

Summary A stored Cross-site Scripting XSS vulnerability was identified in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of...

CVE-2026-61498

creationtimestamp| type| source ---|---|--- 2026-07-13 14:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjuqh3mjq2b 2026-07-13 14:48:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjwr43qom2q 2026-07-13 17:58:09+00:00| seen|...

CVE-2026-61976

creationtimestamp| type| source ---|---|--- 2026-07-13 12:09:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjnulvaea2f 2026-07-13 13:39:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjswlvtwy2k 2026-07-13 15:44:34+00:00| seen|...

CVE-2026-61955

creationtimestamp| type| source ---|---|--- 2026-07-13 11:59:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjndygvcm2y 2026-07-13 18:04:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkbqk2co427 2026-07-14 02:02:07+00:00| seen|...

CVE-2026-59516

creationtimestamp| type| source ---|---|--- 2026-07-13 11:54:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjn2rtdon22 2026-07-13 19:04:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkf3xenwt2z 2026-07-14 02:05:01+00:00| seen|...

CVE-2026-57745

creationtimestamp| type| source ---|---|--- 2026-07-13 11:35:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjlxnt72w2c 2026-07-16 07:57:36+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqr7kbu6v2q...

CVE-2026-57741

creationtimestamp| type| source ---|---|--- 2026-07-13 11:25:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjlhebvkm2y...

CVE-2026-57728

creationtimestamp| type| source ---|---|--- 2026-07-13 11:19:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjl3decem2e 2026-07-16 07:56:52+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqr6ay6ty2b...

CVE-2026-57710

creationtimestamp| type| source ---|---|--- 2026-07-13 11:18:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjkzd2pp525...

CVE-2026-22096

creationtimestamp| type| source ---|---|--- 2026-07-13 11:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjkkyqbj62r 2026-07-13 18:49:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkeb3m33j2e 2026-07-14 03:05:36+00:00| seen|...