37342 matches found
GHSA-GMFW-G93R-VG53 Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)
Summary The Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact wit...
CGA-7F54-J9QG-6RVJ
Bulletin has no description...
MINI-R224-823J-74F2
Bulletin has no description...
MINI-H67R-2M7G-5869
Bulletin has no description...
CVE-2026-6454
The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...
CVE-2026-16353
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the DOM: Bindings WebIDL component...
CVE-2026-16351
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Navigation component...
CVE-2026-65695
Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute...
EUVD-2026-42365
pypdf: Possible infinite loop for not terminated inline images ASCII85 and ASCIIHex filter...
EUVD-2026-48308
Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute...
CVE-2026-65695 Office-Word-MCP-Server 1.1.11 Path Traversal via document tools
Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute...
ECHO-D974-573E-7A5B
Bulletin has no description...
MINI-Q7XX-F2JR-4RJW
Bulletin has no description...
MINI-V3F4-W963-4M23
Bulletin has no description...
MINI-8V43-QF33-72GX
Bulletin has no description...
MINI-6F5Q-HWRR-C994
Bulletin has no description...
MINI-69PQ-CPWM-XMH5
Bulletin has no description...
MINI-F782-39Q2-JCPX
Bulletin has no description...