Malware in @pyme-web/ui-widget

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview @pyme-web/ui-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @pyme-web/ui-widget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in @pyme-web/ui-base

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-42052: Improper Neutralization of Input During Web Page Generation

Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode for untrusted metadata fields. In this runtime, is raw insertion and HTML escaping is only performed by . Rendered output is then inserted with .html..., allowing...

CVE-2026-3346 Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw

IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2026-3346: Improper Neutralization of Special Elements used in an SQL Command

IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

GHSA-FV5P-P927-QMXR vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-FV5P-P927-QMXR vulnerabilities

Vulnerabilities for packages: py3-langchain-text-splitters, open-webui...

MAL-2026-3118 Malicious code in @pyme-web/ui-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6780882125fbf59796027cea605339595d23058e19a6a2a257637f225adb51e8 The package @pyme-web/ui-base was found to contain malicious code. Source: ghsa-malware...

Malicious code in @pyme-web/ui-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6780882125fbf59796027cea605339595d23058e19a6a2a257637f225adb51e8 The package @pyme-web/ui-base was found to contain malicious code. Source: ghsa-malware...

pcs security update

0.11.10-1.el97.3 - Fixed CVE-2026-4800 by updating pcs-web-ui to 0.1.23.2 Resolves: RHEL-164191...

CVE-2026-4919: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.1 is vulnerable to cross-site scripting. This vulnerability allows an administrative user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-4918: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.1 is vulnerable to stored cross-site scripting. This vulnerability allows an administrative user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2026-34270

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description Insufficient validation of user-supplied input allows an authenticated remote attacker with valid administrative credentials to execute arbitra...

CVE-2026-6829 nesquena hermes-webui Arbitrary Workspace Directory Access

nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk by manipulating workspace path parameters in endpoints such as /api/session/new, /api/session/update,...

Hermes Web UI security vulnerabilities

Hermes Web UI is a lightweight, dark-themed web interface developed by Nathan Esquenazi. Hermes Web UI has a security vulnerability that arises from the fact that environment variables of the active configuration file are not cleared before the next configuration file is loaded when switching...

Hermes Web UI path traversal vulnerability

Hermes Web UI is a lightweight, dark-themed web interface developed by Nathan Esquenazi. Hermes Web UI has a path traversal vulnerability. This vulnerability stems from the /api/session/delete endpoint, where there is an issue with arbitrary file deletion. This allows authenticated attackers to...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-41423 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-41423 Source advisory: GHSA-45Q2-GJVG-7973...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-41423 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-41423 Source advisory:...