CVE-2026-65013

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

PT-2026-63438

Name of the Vulnerable Software and Affected Versions Onlook versions prior to 0.2.32 Description An issue exists where authenticated attackers can access and manipulate resources belonging to other users. This occurs because the tRPC API procedures project.get, member.remove, and...

PT-2026-61574

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description An authorization bypass exists in the KILL statement that allows authenticated database users to terminate LIVE SELECT subscriptions belonging to other users. This occurs because the system fails t...

Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

SummaryAny authenticated user can permanently delete files owned by other users via DELETE /api/v1/files/id when the target file is referenced in any shared chat. The hasaccesstofile authorization gate unconditionally grants access through its shared-chat branch. It checks neither the requesting...

CVE-2026-56336

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal orgid and providerid values. Attackers can enumerate email domains to build mappings of domains to organization UUIDs and SSO provider identifiers...

CVE-2026-10708 Insufficiently Protected Credentials

This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the...

PT-2026-56455

Name of the Vulnerable Software and Affected Versions Adalo affected versions not specified Description This issue allows large-scale data harvesting without the need for app-specific secrets. A single request to a minimal leaderboard component can return user records that include emails, UUIDs,...

CVE-2026-56318: Exposure of Sensitive Information to an Unauthorized Actor

Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validatepasswordcompliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observi...

CVE-2026-45671

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user can permanently delete files owned by other users via DELETE /api/v1/files/id when the target file is referenced in any shared chat. The hasaccesstofile...

EUVD-2026-16482

Open WebUI's processfilesbatch endpoint missing ownership check, allows unauthorized file overwrite...

CVE-2026-27705: Authorization Bypass Through User-Controlled Key

Plane is an an open-source project management tool. Prior to version 1.2.2, the ProjectAssetEndpoint.patch method in apps/api/plane/app/views/asset/v2.py lines 579–593 performs a global asset lookup using only the asset ID pk via FileAsset.objects.getid=pk, without verifying that the asset belong...

Insecure Direct Object Reference (IDOR)

pretix is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to insufficient authorization checks on file UUIDs, which allows an attacker to access sensitive files of other users by manipulating or guessing valid UUID values...

AlmaLinux 10 : keylime (ALSA-2025:23201)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:23201 advisory. keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration CVE-2025-13609 Tenable has extracted the preceding description block directl...

SUSE-SU-2025:21194-1 Security update for keylime

This update for keylime fixes the following issues: Update to version 7.13.0+40. Security issues fixed: - CVE-2025-13609: possible agent identity takeover due to registrar allowing the registration of agents with duplicate UUIDs bsc1254199. - CVE-2025-1057: registrar denial-of-service due to...

CVE-2025-66565

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator crypto/rand fails, both functions silently fall back to returning predictable UUID values, including the zero UUID...

Malicious Package

Overview chai-uuids is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in chai-uuids (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42324f1af790a75f6b7a0e081a7d97f1e299d3d3c8c815e37c594d0835ced4a6 The package chai-uuids was found to contain malicious code. Source: ghsa-malware 35cdb6e3e91aabd46ed85adb22b6972f688ae93b61f82f3cb8e2adb8f4294c48 Any...

EUVD-2025-201910

Malicious code in chai-uuids npm...

MAL-2025-192383 Malicious code in chai-uuids (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42324f1af790a75f6b7a0e081a7d97f1e299d3d3c8c815e37c594d0835ced4a6 The package chai-uuids was found to contain malicious code. Source: ghsa-malware 35cdb6e3e91aabd46ed85adb22b6972f688ae93b61f82f3cb8e2adb8f4294c48 Any...

CVE-2025-66565: Unchecked Return Value

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator crypto/rand fails, both functions silently fall back to returning predictable UUID values, including the zero UUID...