124812 matches found
CVE-2026-60135
An attacker can modify data that should be restricted to read‑only access...
GHSA-V6W6-358X-2433 Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests
Summary Cloudreve exposes two admin node test endpoints under the Admin.Read OAuth scope. These endpoints accept attacker-controlled node definitions and cause Cloudreve to make outbound server-side network requests. This allows an OAuth client authorized only for Admin.Read to trigger operationa...
GHSA-68R5-9HPG-7QW9 OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
The DSMLv2 SOAP gateway opendj-dsml-servlet in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker...
EUVD-2026-42639
Open WebUI: Arena task endpoints can bypass underlying model access controls...
GHSA-M3QF-58WF-W979 Open WebUI: Arena task endpoints can bypass underlying model access controls
Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...
GHSA-2XWM-4H2Q-GGFX Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Summary Current main and v0.9.6 still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model. This is an incomplete-fix variant of GHSA-vjqm-6gcc-62cr. The current fix adds...
GHSA-HQ88-5X99-X3GF Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials
Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to Admin.Read but not Admin.Write can call POST /api/v4/admin/policy/oauth/signin and update OneDrive storage policy credentials. The route is inside the admin group...
Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials
Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to Admin.Read but not Admin.Write can call POST /api/v4/admin/policy/oauth/signin and update OneDrive storage policy credentials. The route is inside the admin group...
CVE-2026-57530
Milkdown (versions
GO-2026-5208 Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown
Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown...
AZL-93393 CVE-2026-66034 affecting package libssh2 for versions less than 1.11.1-5
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...
AZL-93402 CVE-2026-66033 affecting package libssh2 for versions less than 1.11.1-5
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...
CVE-2026-66033
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...
DEBIAN-CVE-2026-66034
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...
UBUNTU-CVE-2026-66033
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...
CVE-2026-66033
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...
UBUNTU-CVE-2026-66034
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...
GHSA-7R7X-GJVR-448G Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...
CVE-2026-66034 libssh2 Heap Out-of-Bounds Read via publickey subsystem
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...
EUVD-2026-48721
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...