CVE-2025-41269: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating...

CVE-2025-41273: Authentication Bypass Using an Alternate Path or Channel

Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authentication of the Console web application and...

CVE-2025-41279: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the Administration WebUI in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating syste...

Open WebUI AI-based web interface SSRF

The vulnerability of the validateurl function in the Open WebUI AI-based web interface is related to insufficient validation of requests at the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

Open WebUI Authentication Bypass

The vulnerability of the Open WebUI web interface, based on artificial intelligence, is related to deficiencies in the authentication process when processing the bypassfilter parameter for endpoints like /openai/chat/completions and /ollama/api/chat. Exploiting this vulnerability allows a malicio...

Open WebUI AI-based web interface update_message_by_id() Data Access

The vulnerability of the updatemessagebyid function in the Open WebUI AI-based web interface relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an attacker to gain access to read, modify, or delete data...

Open WebUI XSS

The vulnerability in the Open WebUI web interface is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Open WebUI Authentication Bypass

The vulnerability of the Open WebUI web interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain access to read and modify data remotely...

Open WebUI AI-based web interface DOMPurify XSS

The vulnerability of the DOMPurify.sanitize function in the Open WebUI AI-based web interface is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2026-21785

A misconfigured Content Security Policy CSP in HCL BigFix Remote Control Server WebUI versions 10.1.0.0442 and earlier fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources...

gryannote (>=0.3.1, <=0.3.3), scraibe-webui (0.1.0) potentially affected by CVE-2026-48545 via gradio (4.27.0)

gradio PYPI version 4.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gryannote =0.3.1, =0.3.3 - scraibe-webui 0.1.0 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...

gradio-picto-gallery (0.0.8), scraibe-webui (>=0.1.2.dev107, <=0.2.1) +1 more potentially affected by CVE-2026-48545 via gradio (5.5.0)

gradio PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-picto-gallery 0.0.8 - scraibe-webui =0.1.2.dev107, =0.2.1 - tts-webui 0.0.1 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3...

autobiasdetector (0.0.2), chat-with-mlx (>=0.2.0, <=0.2.2) +6 more potentially affected by CVE-2026-48545 via gradio (4.29.0)

gradio PYPI version 4.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autobiasdetector 0.0.2 - chat-with-mlx =0.2.0, =0.1.1, =0.0.1, =0.0.1, =1.3.0, =1.4.3 Source cves: CVE-2026-48545 Source advisory:...

gryannote (>=0.3.1, <=0.3.3), scraibe-webui (0.1.0) potentially affected by CVE-2026-48545 via gradio (4.27.0)

gradio PYPI version 4.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gryannote =0.3.1, =0.3.3 - scraibe-webui 0.1.0 Source cves: CVE-2026-48545 Source advisory: OSV:PYSEC-2026-2178...

gradio-picto-gallery (0.0.8), scraibe-webui (>=0.1.2.dev107, <=0.2.1) +1 more potentially affected by CVE-2026-48545 via gradio (5.5.0)

gradio PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-picto-gallery 0.0.8 - scraibe-webui =0.1.2.dev107, =0.2.1 - tts-webui 0.0.1 Source cves: CVE-2026-48545 Source advisory: OSV:PYSEC-2026-2178...

HCL BigFix Remote Control Server WebUI security vulnerability

HCL BigFix Remote Control Server WebUI is a web interface provided by the Indian company HCL for remote management and control. HCL BigFix Remote Control Server WebUI versions 10.1.0.0442 and earlier have security vulnerabilities. These vulnerabilities stem from incorrect configuration of content...

CVE-2026-21785: Improper Restriction of Rendered UI Layers or Frames

A misconfigured Content Security Policy CSP in HCL BigFix Remote Control Server WebUI versions 10.1.0.0442 and earlier fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources...

[SECURITY] Fedora 42 Update: nodejs-aw-webui-0^20260516.8d9a7f8-1.fc42

A web-based UI for ActivityWatch, built with Vue.js...

[SECURITY] Fedora 44 Update: nodejs-aw-webui-0^20260516.8d9a7f8-1.fc44

A web-based UI for ActivityWatch, built with Vue.js...

Fedora 43 : aw-server-rust / awatcher / nodejs-aw-webui (2026-c9d4e8b9a4)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c9d4e8b9a4 advisory. Rebuilt with openssl 0.10.79 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...