31669 matches found
CVE-2026-87735
An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption...
PT-2026-88814
An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption...
CVE-2026-88002: Loop with Unreachable Exit Condition
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/openwebui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id...
PT-2026-89179
Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...
PT-2026-89171
Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
SAP NetWeaver Missing Authentication (3759472)
The version of the SAP NetWeaver kernel detected on the remote host is affected by a missing authentication vulnerability as referenced in SAP Security Note 3759472: - SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during...
PT-2026-89177
Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...
EUVD-2026-65123
CakePHP: SmtpTransport vulnerable to CRLF header injection...
DEBIAN-CVE-2026-19872
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
CVE-2026-19872
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
UBUNTU-CVE-2026-19872
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
EUVD-2026-74166
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
CVE-2026-19872
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
CVE-2026-19872 HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
CVE-2026-19872
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
CVE-2026-19872 HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
CVE-2026-66306
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network...
CVE-2026-66306
Skype for Business Server (Subscription Edition, 2019, and 2015) is affected by an information disclosure vulnerability caused by the generation of error messages containing sensitive information , allowing an unauthorized attacker to disclose information over a network. The CVSS 3.1 score is 6.5...