992146 matches found
CVE-2026-82411 Objects API: Cross-object-type authorization bypass on the object history-detail endpoint
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET...
CVE-2026-82411
The Open Object platform is vulnerable to a cross-object-type authorization bypass in the history-detail endpoint (GET /api/v2/objects/{uuid}/{index}). The flaw exists because the history_detail action in src/objects/api/v2/views.py calls self.get_queryset() and get_object_or_404 directly, bypass...
EUVD-2026-110046
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute...
EUVD-2026-110040
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference Old Opsets, Missing Rank Check...
Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI
Summary Echo's dedicated open-redirect guard, sanitizeURI, decides whether a redirect target is a local path by inspecting exactly two byte positions: uri0 and uri1. If the value begins with a control character such as a tab or a newline, followed by a separator pair, the guard does not fire and...
GHSA-V753-G4CW-JM48 Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI
Summary Echo's dedicated open-redirect guard, sanitizeURI, decides whether a redirect target is a local path by inspecting exactly two byte positions: uri0 and uri1. If the value begins with a control character such as a tab or a newline, followed by a separator pair, the guard does not fire and...
Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
Summary The c.Scheme method in Echo context.go:162-181 trusts the X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme request headers without validating that the value is http or https. The WWWRedirect and NonWWWRedirect middlewares use this unsanitized scheme to construct redirect URLs,...
GHSA-JJ7H-C3HG-M23X vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-114614 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-114617 vulnerabilities
Vulnerabilities for packages: open-webui, airflow, pgadmin4-fips, pgadmin4...
CVE-2026-114619 vulnerabilities
Vulnerabilities for packages: open-webui, airflow, pgadmin4-fips, pgadmin4...
CVE-2026-114620 vulnerabilities
Vulnerabilities for packages: open-webui, airflow, pgadmin4-fips, pgadmin4...
GHSA-C5MF-XMP2-59RC vulnerabilities
Vulnerabilities for packages: open-webui, airflow, pgadmin4-fips, pgadmin4...
GHSA-6M87-8WG6-HH8W vulnerabilities
Vulnerabilities for packages: open-webui, airflow, pgadmin4-fips, pgadmin4...
CVE-2026-114615 vulnerabilities
Vulnerabilities for packages: open-webui, airflow, pgadmin4-fips, pgadmin4...
GHSA-7VR2-2FGP-9W7P vulnerabilities
Vulnerabilities for packages: open-webui, airflow, pgadmin4-fips, pgadmin4...
CVE-2026-96760 vulnerabilities
Vulnerabilities for packages: open-webui, airflow, pgadmin4-fips, pgadmin4...
GHSA-FCH4-3C6X-J4GC vulnerabilities
Vulnerabilities for packages: open-webui, airflow, pgadmin4-fips, pgadmin4...