37510 matches found
GHSA-CWPJ-H54C-XJPX ImageMagick: Policy Bypass in PSD decoder
Due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply...
Allocation of Resources Without Limits or Throttling
Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
MINI-CPX2-MXJC-3WV3
Bulletin has no description...
CGA-7JHC-9V5P-RWV9
Bulletin has no description...
CVE-2026-44549
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheettohtml to embed an XSS payload into the generated...
CVE-2026-41949 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the...
CVE-2026-41949 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the...
EUVD-2026-30774
Dify version 1.14.1 and prior contain an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the...
CVE-2026-41949
Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the...
JLSEC-2026-500
Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the --extract-media option or outputting to PDF format. This allows an attacker to create or overwrite arbitrary files, depending on the privileges of...
MINI-3735-JX47-4C5M
Bulletin has no description...
PT-2026-41676
Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.14.2 Description An authorization bypass exists in the file preview endpoint, allowing any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces. This occurs becau...
PT-2026-41768
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A missing check in the PSD decoder allows the list-length resource policy to be bypassed during the decoding of a PSD image. Other security limits remain active...
Vulnerability of the DOM component: The security features of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allow attackers to circumvent existing security restrictions.
Vulnerability of the DOM component: The security of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relies on bypassing authentication using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...
dify 安全漏洞
dify is an open-source LLM application development platform by LangGenius. Versions of dify prior to 1.14.1 have a security vulnerability. This vulnerability stems from an authorization bypass issue in the file preview endpoint, which allows any authenticated user to read the first 3,000 characte...
PT-2026-41790
Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions 0.1.0 through 0.8.0 Description Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and caus...
MINI-XCF6-9JHQ-RQXQ
Bulletin has no description...
MINI-5R3H-V7V6-V8FQ
Bulletin has no description...
