CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write CVSS 9.8 Critical · CWE-22 · GHSA/Issue 3104 Summary POST /api/v1/python/file/upload in DB-GPT v0.8.1 takes the user-id HTTP header and uses it raw as a path component : uploaddir = os.path.joinbasedir,...

CVE-2025-6783

Inject an always-true condition into the WHERE clause so that every row matches: curl -i -X POST \ -H "Content-Type: application/json" \ -H "forms-id: poc-001' OR '1'='1' -- " \ -H "domain-id: example.com" \ -d ' "emabedtype":"iframe", "shortcodetitle":"INJECTED", "shortcodetag":"xss", "active":0...

CVE-2025-59342

CVE-2025-59342 - Path Traversal esm-dev Author: Byte Reaper Description CVE-2025-59342 is a path traversal vulnerability in esm.sh, a nobuild content delivery network CDN for modern web development, in version 136 and earlier. The issue exists in the handling of the X-Zone-Id HTTP header, which i...

CVE-2026-119703

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer.handleauth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

CVE-2026-119703

The xiaozhi-esp32-server (through version 0.9.8 ) is vulnerable to an authentication bypass in the WebSocketServer._handle_auth function. This flaw allows remote unauthenticated attackers to bypass Bearer HMAC token verification by spoofing the Device-ID header with an allowlisted MAC-address-sha...

CVE-2026-119703 xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer.handleauth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

EUVD-2026-114108

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer.handleauth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

CVE-2026-119703 xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer.handleauth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

PT-2026-133637

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer. handle auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

CVE-2026-119703: xinnan-tech xiaozhi-esp32-server: xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that…

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer.handleauth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

PT-2026-117955

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user id HTTP header. Attackers can set user id to another tenant's ID, even with LETTA SERVER SECURE enabled, to read and modify that user's agents,...

Exploit for Missing Authentication for Critical Function in Gfi Kerio_Control

!WARNING DISCLAIMER This proof-of-concept is provide...

EUVD-2026-75412

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/backend/utils/honomiddleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and t...

CVE-2026-16637 OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

EUVD-2026-54479

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

PYSEC-2026-3600 Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Summary The terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...

PYSEC-2026-3597 open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...

User Impersonation

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to User Impersonation via the wsterminal process. An attacker can gain unauthorized access to another user's terminal session by injecting crafted values into the sessionid parameter, causing the backend to...

CVE-2024-58368

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server...

CVE-2026-52869

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamablehttpmanager.StreamableHTTPSessionManager route requests to existing...