18240 matches found
motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution
Summary The ActionHandler.post method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts PTZ controls, alarm triggers, etc.. Vulnerability Details File:...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the post function in the ActionHandler process. An attacker can execute camera actions such as triggering snapshots, starting or stopping video recording, or running configured action scripts without...
GHSA-J67X-Q29F-QCVV motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution
Summary The ActionHandler.post method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts PTZ controls, alarm triggers, etc.. Vulnerability Details File:...
CVE-2026-54007
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim...
CVE-2026-54306
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as norma...
CVE-2026-54007 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim...
CVE-2026-54007 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim...
‘Cordyceps’ CI/CD Flaw Exposes Microsoft, Google, Apache Repos to Pipeline Hijacking
Novee Security reveals Cordyceps, a CI/CD vulnerability in GitHub Actions workflows that let anonymous users poison builds and expose tokens across major projects today...
CVE-2026-56115
Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but...
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub is moving to strengthen software supply chain security by updating "actions/checkout" to block pwn request attacks that exploit the risky use of the "pullrequesttarget workflow" trigger to run malicious code with the workflow's full privileges. Effective June 18, 2026, the latest version o...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: saf, py3-captum, commercial-gitlab-rails-ee-fips, renovate, code-server, commercial-gitlab-rails-ee, prism, kibana, vitess, npm, haraka, pelias-api, node-gyp, gemini-cli, actions-runner...
GHSA-G8M3-5G58-FQ7M vulnerabilities
Vulnerabilities for packages: saf, py3-captum, commercial-gitlab-rails-ee-fips, renovate, code-server, commercial-gitlab-rails-ee, prism, kibana, vitess, npm, haraka, pelias-api, node-gyp, gemini-cli, actions-runner...
GHSA-VXPW-J846-P89Q vulnerabilities
Vulnerabilities for packages: saf, py3-captum, commercial-gitlab-rails-ee-fips, renovate, code-server, commercial-gitlab-rails-ee, prism, kibana, vitess, npm, haraka, pelias-api, node-gyp, gemini-cli, actions-runner...
CVE-2026-6733 vulnerabilities
Vulnerabilities for packages: saf, py3-captum, commercial-gitlab-rails-ee-fips, renovate, code-server, commercial-gitlab-rails-ee, prism, kibana, vitess, npm, haraka, pelias-api, node-gyp, gemini-cli, actions-runner...
CVE-2026-11525 vulnerabilities
Vulnerabilities for packages: saf, py3-captum, commercial-gitlab-rails-ee-fips, renovate, code-server, commercial-gitlab-rails-ee, prism, kibana, vitess, npm, haraka, pelias-api, node-gyp, gemini-cli, actions-runner...
CVE-2026-9679 vulnerabilities
Vulnerabilities for packages: saf, py3-captum, commercial-gitlab-rails-ee-fips, renovate, code-server, commercial-gitlab-rails-ee, prism, kibana, vitess, npm, haraka, pelias-api, node-gyp, gemini-cli, actions-runner...
GHSA-35P6-XMWP-9G52 vulnerabilities
Vulnerabilities for packages: saf, py3-captum, commercial-gitlab-rails-ee-fips, renovate, code-server, commercial-gitlab-rails-ee, prism, kibana, vitess, npm, haraka, pelias-api, node-gyp, gemini-cli, actions-runner...
GHSA-P88M-4JFJ-68FV vulnerabilities
Vulnerabilities for packages: saf, py3-captum, commercial-gitlab-rails-ee-fips, renovate, code-server, commercial-gitlab-rails-ee, prism, kibana, vitess, npm, haraka, pelias-api, node-gyp, gemini-cli, actions-runner...
PT-2026-55664
Summary A multi‑stage chain in motionEye leads to remote code execution. The chain combines: 1. Arbitrary file read LFI via the picture download endpoint for local motion cameras using absolute paths. 2. Pass‑the‑hash admin auth due to accepting request signatures computed with password hashes. 3...
CVE-2026-54007: Origin Validation Error
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim...