MAL-2026-6636 Malicious code in @partner-apps/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91a55f75e5401bc702943c887c3e72fb80f4a7f21bb34f65350fc54aeaf999d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6627 Malicious code in @huobi-ui/activity-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2dc07679f0c801fbb465a2502687e29ed687871964c5d84c0dd5f2b7f94e8ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6667 Malicious code in player-core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0125c3ddfa61335d33bb6254aa2542b3dc7d561dce6e8fdf7580b28b05cd710 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

SummaryA Path Traversal vulnerability allows any user or attacker supplying an untrusted statetoken through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service via crash loops when reading...

PYSEC-2026-430 OpenStack Murano Code Execution

OpenStack Murano before 1.0.3 liberty and 2.x before 2.0.1 mitaka, Murano-dashboard before 1.0.3 liberty and 2.x before 2.0.1 mitaka, and python-muranoclient before 0.7.3 liberty and 0.8.x before 0.8.5 mitaka improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files,...

PYSEC-2026-429 OpenStack Murano Code Execution

OpenStack Murano before 1.0.3 liberty and 2.x before 2.0.1 mitaka, Murano-dashboard before 1.0.3 liberty and 2.x before 2.0.1 mitaka, and python-muranoclient before 0.7.3 liberty and 0.8.x before 0.8.5 mitaka improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files,...

MAL-2026-6569 Malicious code in longzy-basic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90336f7ef2177c75d9cf4a1872fe94504a382dfd1907e7617e0e06642f2dae67 On npm install, the package's postinstall hook executes .prepare.cjs, which collects the installer's hostname, username, platform, Node version,...

PT-2026-53493

Summary A Path Traversal vulnerability allows any user or attacker supplying an untrusted state token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service via crash loops when reading...

OPENSUSE-SU-2026:11128-1 agama-web-ui-22+143.ee15dea20-46.1 on GA media

These are all security issues fixed in the agama-web-ui-22+143.ee15dea20-46.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2026-37516

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication...

Debug Messages Revealing Unnecessary Information

Overview backpropagate is a Production-ready headless LLM fine-tuning with smart defaults, Windows support, and modular architecture Affected versions of this package are vulnerable to Debug Messages Revealing Unnecessary Information in the authentication process. An attacker can gain unauthorize...

GHSA-JM82-FX9C-MX94 vulnerabilities

Vulnerabilities for packages: nemo, open-webui...

CVE-2026-54531 vulnerabilities

Vulnerabilities for packages: open-webui...

GO-2026-5733 Nginx-UI: Disabled users retain full API access through previously issued bearer tokens in github.com/0xJacky/Nginx-UI

Nginx-UI: Disabled users retain full API access through previously issued bearer tokens in github.com/0xJacky/Nginx-UI...

GO-2026-5719 Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services in github.com/0xJacky/Nginx-UI

Nginx-UI has Server-Side Request Forgery SSRF via Cluster Proxy Middleware that Allows Access to Internal Services in github.com/0xJacky/Nginx-UI...

GO-2026-5632 Pelican Web UI Affected by a Privilege Escalation Attack in github.com/pelicanplatform/pelican

Pelican Web UI Affected by a Privilege Escalation Attack in github.com/pelicanplatform/pelican...

GO-2026-5521 Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui

Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui...

GO-2026-5577 Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component in github.com/kyverno/policy-reporter-ui

Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component in github.com/kyverno/policy-reporter-ui...

GO-2026-5565 Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui

Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...

GO-2026-5412 Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI

Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...