Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the metadata endpoints, which fail to sanitize sensitive fields from user profiles. An attacker can obtain OAuth2 access and refresh tokens belonging to other users by...

Incorrect Authorization

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Incorrect Authorization via the assign process. An attacker can gain unauthorized access to other applications and assign elevated roles to themselves or other users by exploiting insufficient...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-turbopack versions = 19.0.0, 19.0.8...

react-server-dom: Denial of Service in Server Functions

Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7,...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-webpack versions = 19.0.0, 19.0.8...

EUVD-2026-46307

react-server-dom: Denial of Service in Server Functions...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-parcel versions = 19.1.0, 19.1.9...

GHSA-FRVJ-C5QP-XJ4W open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, kibana, langfuse, wazuh-dashboard-fips, librechat, wazuh-dashboard, nextcloud-server, langfuse-fips...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, opensearch-dashboards, kibana, langfuse, wazuh-dashboard-fips, librechat, wazuh-dashboard, nextcloud-server, langfuse-fips...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, opensearch-dashboards, kibana, langfuse, wazuh-dashboard-fips, librechat, wazuh-dashboard, nextcloud-server, langfuse-fips...

CVE-2026-65900 vulnerabilities

Vulnerabilities for packages: kibana, langfuse, wazuh-dashboard-fips, librechat, wazuh-dashboard, nextcloud-server, langfuse-fips...

CVE-2026-65901 vulnerabilities

Vulnerabilities for packages: kibana, langfuse, wazuh-dashboard-fips, librechat, wazuh-dashboard, nextcloud-server, langfuse-fips...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: kibana, langfuse, wazuh-dashboard-fips, librechat, wazuh-dashboard, nextcloud-server, langfuse-fips...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server, langfuse...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: nextcloud-server, langfuse...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: nextcloud-server, langfuse...

CVE-2026-65900 vulnerabilities

Vulnerabilities for packages: nextcloud-server, langfuse...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server, langfuse...

CVE-2026-65901 vulnerabilities

Vulnerabilities for packages: nextcloud-server, langfuse...