PYSEC-2026-1675 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript e.g., an XSS payload, accessing this URL via a browser leads to the execution of the script in the context of the Mob...

PYSEC-2026-1671 Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

Vulnerable MobSF Versions: = v4.3.2 Details: MobSF is a widely adopted mobile application security testing tool used by security teams across numerous organizations. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web application...

Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Vulnerable MobSF Versions: = v4.3.2CVSS V4.0 Score: 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:NDetails:A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions ≤ 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG...

boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-48588 via django (2.1.4)

django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-48588 via django (2.2.7)

django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-53878 via django (2.1.4)

django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-53877 via django (2.1.4)

django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-53877 via django (2.2.7)

django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-53878 via django (2.2.7)

django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

GO-2026-5911 Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder...

GO-2026-5878 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags in goshs.de/goshs

goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags in goshs.de/goshs...

Gradio DOS in multipart boundry while uploading the file

A vulnerability in the file upload process of gradio-app/gradio version @gradio/[email protected] allows for a Denial of Service DoS attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue...

PYSEC-2026-1410 Gradio DOS in multipart boundry while uploading the file

A vulnerability in the file upload process of gradio-app/gradio version @gradio/[email protected] allows for a Denial of Service DoS attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue...

PYSEC-2026-1861 Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

A Denial of Service DoS vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource consumption by appending characters to the end of a multipart boundary in an HTTP request. This leads to the server continuously processing ea...

Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

A Denial of Service DoS vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource consumption by appending characters to the end of a multipart boundary in an HTTP request. This leads to the server continuously processing ea...

PYSEC-2026-1731 Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint

In open-webui version 0.3.8, the endpoint /models/upload is vulnerable to arbitrary file write due to improper handling of user-supplied filenames. The vulnerability arises from the usage of filepath = f"UPLOADDIR/file.filename" without proper input validation or sanitization. An attacker can...

PYSEC-2026-1730 Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint

In open-webui version 0.3.8, the endpoint /models/upload is vulnerable to arbitrary file write due to improper handling of user-supplied filenames. The vulnerability arises from the usage of filepath = f"UPLOADDIR/file.filename" without proper input validation or sanitization. An attacker can...

Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload

A Stored Cross-Site Scripting XSS vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. Th...