50167 matches found
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected ComponentSocket.IO session state and role-check callsites:- backend/openwebui/socket/main.py lines 330-351, connect handler — role snapshotted into SESSIONPOOL- backend/openwebui/socket/main.py lines...
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
Description OverviewLemur's LDAP authentication module lemur/auth/ldap.py constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries...
PYSEC-2026-2585 Lemur: LDAP Filter Injection enables post-authentication privilege escalation
Description Overview Lemur's LDAP authentication module lemur/auth/ldap.py constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership querie...
PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
SummaryThe /api/v1/runs endpoint accepts an arbitrary webhookurl in the request body with no URL validation. When a submitted job completes success or failure, the server makes an HTTP POST request to this URL using httpx.AsyncClient. An unauthenticated attacker can use this to make the server se...
PYSEC-2026-2896 PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS
Summary The WSGI-based recipe registry server server.py reads the entire HTTP request body into memory based on the client-supplied Content-Length header with no upper bound. Combined with authentication being disabled by default no token configured, any local process can send arbitrarily large...
CVE-2026-62147
creationtimestamp| type| source ---|---|--- 2026-07-13 14:07:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjuimxr2t2x 2026-07-13 14:27:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjvlyzosg2c 2026-07-13 19:27:38+00:00| seen|...
CVE-2026-61971
creationtimestamp| type| source ---|---|--- 2026-07-13 13:41:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjszxizpy2q 2026-07-13 21:32:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqknduvgfx2d 2026-07-14 02:49:10+00:00| seen|...
CVE-2026-61983
creationtimestamp| type| source ---|---|--- 2026-07-13 13:33:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjskvppzu2i 2026-07-13 15:43:10+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqjztca5rv2j 2026-07-13 19:48:17+00:00| seen|...
CVE-2026-61970
creationtimestamp| type| source ---|---|--- 2026-07-13 13:18:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjrqelee42x...
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service PhaaS operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle AitM tactics, antibot evasion, artificial intelligence AI-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed...
CVE-2026-40468
creationtimestamp| type| source ---|---|--- 2026-07-13 12:45:03+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-40467 2026-07-13 14:27:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjvmgqzan27 2026-07-13 18:05:16+00:00| seen|...
CVE-2026-12257
Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution RCE vulnerability. The flaw is located in the endpoint “/index.cfm/api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion...
CVE-2026-40553
creationtimestamp| type| source ---|---|--- 2026-07-13 12:15:08+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-40467 2026-07-13 13:48:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjtfjqc2y26 2026-07-13 16:14:50+00:00| seen|...
CVE-2026-40469
creationtimestamp| type| source ---|---|--- 2026-07-13 12:15:05+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-40467 2026-07-13 13:50:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjtjz4kbz26 2026-07-14 10:42:05+00:00| seen|...
CVE-2026-40467
creationtimestamp| type| source ---|---|--- 2026-07-13 12:15:03+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-40467 2026-07-13 13:59:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqju2ajlcl2q 2026-07-13 16:33:11+00:00| seen|...
CVE-2026-57816
creationtimestamp| type| source ---|---|--- 2026-07-13 12:09:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjnvukf5m2y 2026-07-13 21:31:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkncjxa5h2a 2026-07-14 02:26:29+00:00| seen|...
CVE-2026-61968
creationtimestamp| type| source ---|---|--- 2026-07-13 12:09:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjnuhgoww2d 2026-07-13 15:45:57+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqjzyb74p42b 2026-07-13 19:10:02+00:00| seen|...
CVE-2026-61977
creationtimestamp| type| source ---|---|--- 2026-07-13 12:03:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjnl3rpau2y 2026-07-13 13:53:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjtovidza27 2026-07-14 02:38:39+00:00| seen|...
CVE-2026-59521
creationtimestamp| type| source ---|---|--- 2026-07-13 11:55:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjn4eonhm2z 2026-07-13 19:45:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkhecakde22 2026-07-14 02:20:17+00:00| seen|...