72370 matches found
CVE-2026-54015 Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the promptid in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that...
CVE-2026-44274
creationtimestamp| type| source ---|---|--- 2026-06-23 16:26:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116800356044077803...
CVE-2026-48519
Langflow CVE-2026-48519 exposes unauthenticated RCE via the Shareable Playground. Affected: Langflow prior to 1.9.2. Vulnerable route: /api/v1/build_public_tmp permits executing any public flow; payloads can inject arbitrary Python code into data.nodes[X].data.node.template.code.value. Impact is ...
CVE-2026-56695 OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
OpenHarness ohmo gateway /resume and /summary slash commands default remoteinvocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and...
EUVD-2026-38463
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response...
CVE-2026-56402 NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler
NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response...
CVE-2026-55555
creationtimestamp| type| source ---|---|--- 2026-06-23 14:34:07+00:00| published-proof-of-concept| https://hakaisecurity.io/explorando-geradores-de-pdf-0-days-em-90-milhoes-de-alvos-por-mes/research-blog 2026-06-23 14:34:07+00:00| published-proof-of-concept|...
CVE-2026-56274
creationtimestamp| type| source ---|---|--- 2026-06-23 14:27:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxmasquup2a 2026-06-25 05:40:10+00:00| seen| https://gist.github.com/muhamedfazalps/db2c0e46436e75ee35dd214e14e27b40 2026-07-10 11:37:06+00:00| seen|...
CVE-2026-56225
creationtimestamp| type| source ---|---|--- 2026-06-23 14:19:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxlsg2pk52s...
CVE-2026-56315
creationtimestamp| type| source ---|---|--- 2026-06-23 14:12:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxlh2kytx2w...
CVE-2025-71337
creationtimestamp| type| source ---|---|--- 2026-06-23 14:00:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxks42chc2l 2026-07-10 12:07:10+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqc4e6fhnr2m...
CVE-2025-71365
creationtimestamp| type| source ---|---|--- 2026-06-23 13:49:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxk6f6zbv2o...
GHSA-74P7-6H78-GW8P
creationtimestamp| type| source ---|---|--- 2026-06-23 13:42:51+00:00| seen| https://gist.github.com/alon710/11eb496838c824b891dd239de0d0e0b4 2026-06-23 13:51:48+00:00| seen| https://gist.github.com/alon710/ba15b4769d69aa0e2cc9924898cce4e0...
MINI-9PWC-4494-P948
Bulletin has no description...
MINI-FJ5C-J668-JC32
Bulletin has no description...
MINI-QFFX-QXVG-CHFM
Bulletin has no description...
MINI-C36V-XQ37-RM9Q
Bulletin has no description...
MINI-C27Q-F958-V72P
Bulletin has no description...