989359 matches found
PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
Summarypraisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhookURLs by resolving the hostname and checking whether the IP is private. When DNSresolution fails socket.gaierror, the validator silently passes the URL viaexcept socket.gaierror: pass. Additionally, even when DNS...
open-rag-eval (>=0.2.4, <=0.3.0) potentially affected by CVE-2026-9856 via transformers (4.50.2)
transformers PYPI version 4.50.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - open-rag-eval =0.2.4, =0.3.0 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...
CVE-2026-8323
URL redirection to untrusted site 'open redirect' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of Data. This issue affects Access Control System: before Versiyon 2...
CVE-2026-8323
An open redirect vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (versions before Version 2 ) allows an attacker to redirect users to an untrusted site, thereby faking the source of data . The CNA-assigned CVSS 3.1 score is 9.3 (CRITICAL) with vector CVSS:3.1/AV:N/...
CVE-2026-8323 Open Redirect in Armiya Information Technologies' Access Control System
URL redirection to untrusted site 'open redirect' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of Data. This issue affects Access Control System: before Versiyon 2...
CVE-2026-8323 Open Redirect in Armiya Information Technologies' Access Control System
URL redirection to untrusted site 'open redirect' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of Data. This issue affects Access Control System: before Versiyon 2...
EUVD-2026-75328
URL redirection to untrusted site 'open redirect' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of Data. This issue affects Access Control System: before Versiyon 2...
PCAPdroid v2.0.1
PCAPdroid PCAPdroid is a privacy-friendly open source app which lets you track, analyze and block the connections made by the other apps in your device. It also allows you to export a PCAP dump of the traffic, inspect HTTP, decrypt TLS traffic and much more! PCAPdroid simulates a VPN in order to...
SUSE CVE-2026-86205
h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...
CLEANSTART-2026-DB46993 Prometheus is an open-source monitoring system and time series database
Multiple security vulnerabilities affect the prometheus-operator package. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...
CVE-2026-88002
creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:06+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6 2026-09-10 02:31:55+00:00| seen| https://gist.github.com/alon710/401536538bb41a7576b21df62b940fb2...
CVE-2026-88001
creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:04+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-5x7x-4c3c-qf5w 2026-09-10 01:32:33+00:00| seen| https://gist.github.com/alon710/855b51c2ea136c7c49beab7d27d1ef40...
CVE-2026-88000
creationtimestamp| type| source ---|---|--- 2026-09-10 00:32:33+00:00| seen| https://gist.github.com/alon710/48cdccd93c734ae28b1351fbe3368bd9 2026-09-10 00:35:02+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-3cgp-3cqx-j8w2...
HOL Guard AI Agent Runtime Security Benchmark
HOL Guard Benchmark is an open source fixture-based benchmark for evaluating security controls applied to AI coding agents. It defines deterministic scenarios covering secret access, risky shell execution, tool poisoning, approval handling, safe operations, and receipt generation across Codex CLI...
PT-2026-89647
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header...
CVE-2026-78374: Insertion of Sensitive Information Into Sent Data
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...
PT-2026-89703
Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...
CVE-2026-8323: URL Redirection to Untrusted Site
URL redirection to untrusted site 'open redirect' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of Data. This issue affects Access Control System: before Versiyon 2...
CVE-2026-88005: Incorrect Authorization
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...
PT-2026-89353
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...