1986 matches found
EUVD-2025-201164
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
PT-2025-49046
Name of the Vulnerable Software and Affected Versions open-webui version 0.6.33 Description The software contains a flaw related to access control. The /api/tasks/stop/ API endpoint allows direct access and cancellation of tasks without verifying user ownership. This enables an attacker, even a...
CVE-2025-63681
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
CVE-2025-63681
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
CVE-2025-63681
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
CVE-2025-63681
Open-WebUI CVE-2025-63681 affects v0.6.33. The API endpoint /api/tasks/stop/ allows direct cancellation of tasks without verifying ownership, enabling a normal user to stop arbitrary LLM response tasks (Incorrect Access Control). Base score 4.3 (Medium); attack vector NETWORK, privileges required...
CVE-2025-63681: Improper Access Control
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
CVE-2025-63396
An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop can cause torch.profiler.profile PythonTracer to crash or hang during finalization, leading to a Denial of Service DoS. Mitigation Mitigation for this issue is either not available or the currently available options do...
Siemens SCALANCE and RUGGEDCOM Devices Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-2024-42232)
libceph: fix race between delayedwork and cephmoncstop The way the delayed work is handled in cephmoncstop is prone to races with monfault and possibly also finishhunting. Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after...
PT-2025-47184
Name of the Vulnerable Software and Affected Versions ESF-IDF versions prior to 5.1.7 ESF-IDF versions prior to 5.2.6 ESF-IDF versions prior to 5.3.5 ESF-IDF versions prior to 5.4.3 ESF-IDF versions prior to 5.5.2 Description ESF-IDF, the Espressif Internet of Things IOT Development Framework, is...
CVE-2025-64307
The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes...
EUVD-2025-176350
Malicious code in sirius-stop-umbra-spawn npm...
EUVD-2025-178717
Malicious code in geodynamo-stop-hexo-markdown-pdf npm...
EUVD-2025-177106
Malicious code in polaris-stop-sails-antares npm...
EUVD-2025-179840
Malicious code in celeste-baryon-stop-nodejs npm...
EUVD-2025-178803
Malicious code in futurology-unuk-config-stop npm...
Malicious code in sirius-stop-umbra-spawn (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e55a14a033b2c4791dbf3754b9d92b6fe7fba60595a0c5234a281f5b9d0c6b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in stop-callback-wezen-quark (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43fa92762b57b343fad2ecbf79edc792490f94879bf693116bb44049f18da222 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-186105 Malicious code in chalk-stop-indus-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87bb8e1129a1d5a199fd42030542e91c8c409a534084d9519532cc4057e92cc4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...