19876 matches found
CVE-2026-59714
creationtimestamp| type| source ---|---|--- 2026-07-24 18:35:10+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-x2ff-v5v8-m75m...
CVE-2026-59222
creationtimestamp| type| source ---|---|--- 2026-07-24 18:35:03+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-gh7p-78x6-jw6m...
KLA91173 Multiple vulnerabilities in Microsoft Browser
Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in Microsoft Edge Chromium-base...
CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...
GO-2026-5987 Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh
The nebula-mesh Web UI host creation ignores the configured enrollment token TTL and instead mints 24-hour bearer enrollment tokens. This can lead to tokens remaining valid for longer than intended, increasing the window of opportunity for an attacker to use an intercepted token...
CVE-2026-59879 vulnerabilities
Vulnerabilities for packages: nextcloud-server, rancher-api-ui, vitess...
GHSA-V56Q-MH7H-F735 vulnerabilities
Vulnerabilities for packages: nextcloud-server, rancher-api-ui, vitess...
CVE-2026-64815
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...
PYSEC-2026-3517 PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
Unauthenticated PraisonAI UI MCP connect endpoint executes attacker-chosen local commands Summary PraisonAI v4.6.48 exposes the PraisonAIUI MCP client management API through the default UI host apps without authentication. A remote unauthenticated client can send POST /api/mcp/connect with a...
PYSEC-2026-3515 PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...
CVE-2026-64815
JetBrains IntelliJ IDEA is affected by CVE-2026-64815 for versions prior to 2026.2. The vulnerability allows arbitrary code injection via UI Designer form files. Root cause details are not provided in the supplied documents, but the weakness enables code execution under certain conditions, as ind...
CVE-2026-64815
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...
CVE-2026-64815
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the Network component of Google Chrome before version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Before version 148.0.7778.216, using free in Google Chrome’s views allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Before version 148.0.7778.216, using free in the UI of Google Chrome allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insecure security user interfaces in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to perform certain UI gestures to perform UI spoofing through a crafted HTML page. Chromium security severity: Low...