CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

341162 matches found

OSV•added 2026/10/01 4:38 p.m.•13 views

PYSEC-2026-4023 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...

7CVSS5.9AI score0.00108EPSS

SaveExploits0References8

PyPA•added 2026/10/01 4:38 p.m.•12 views

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

ImpactFor views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned statejson in their page and return it in the reconnect mount frame to inject arbitrary view...

8.1CVSS6AI score0.00225EPSS

SaveExploits0References6Affected Software1

OSV•added 2026/10/01 4:38 p.m.•6 views

PYSEC-2026-4040 djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

Impact For views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned statejson in their page and return it in the reconnect mount frame to inject arbitrary view...

8.1CVSS6AI score0.00225EPSS

SaveExploits0References6

PyPA•added 2026/10/01 4:38 p.m.•14 views

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

SummaryA user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

6.5CVSS5.7AI score0.00513EPSS

SaveExploits1References7Affected Software1

PyPA•added 2026/10/01 4:38 p.m.•18 views

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

SummaryExternal knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for other...

7.1CVSS5.7AI score0.00486EPSS

SaveExploits1References8Affected Software1

IBM Security Bulletins•added 2026/10/01 4:29 p.m.•16 views

Security Bulletin: Due to Linux, IBM Cloud Pak System is affected by local privilege escalation vulnerability[ CVE-2026-31431]

Summary Vulnerability was found in Linux shipped with IBM Cloud Pak System OS Image for Red hat Linux Systems. Vulnerability was addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-31431 DESCRIPTION: In the Linux kernel, the following vulnerability has been...

7.8CVSS6AI score0.03437EPSS

SaveExploits246Affected Software1

F5 Networks•added 2026/10/01 4:11 p.m.•15 views

K000163505: PostgreSQL vulnerability CVE-2026-6471

Security Advisory Description Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongl...

3.8CVSS6AI score0.00318EPSS

SaveExploits0Affected Software1