Lucene search
+L

553612 matches found

PyPA
PyPA
added 4 days ago8 views

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

SummaryAn authenticated user whose features.imagegeneration permission has been revoked can still make the server generate images by sending the feature flag in a chat-completion request. The chat pipeline took the client-supplied features object at face value and never re-checked the permission...

4.3CVSS5.3AI score0.00267EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 4 days ago11 views

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

SummaryThe built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

6.5CVSS5.5AI score0.00305EPSS
SaveExploits0References8Affected Software1
OSV
OSV
added 4 days ago4 views

PYSEC-2026-3644 Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...

6.5CVSS5.5AI score0.00295EPSS
SaveExploits0References7
OSV
OSV
added 4 days ago8 views

PYSEC-2026-3637 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

6.5CVSS5.6AI score0.00305EPSS
SaveExploits0References8
OSV
OSV
added 4 days ago6 views

PYSEC-2026-3643 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

5.3CVSS5.5AI score0.0025EPSS
SaveExploits0References7
PyPA
PyPA
added 4 days ago9 views

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

SummaryDELETE /api/v1/chats/id cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user's chat id could therefore abort that user's running model response, title generation or tag generation. The deletion...

3.1CVSS5.4AI score0.00244EPSS
SaveExploits0References8Affected Software1
OSV
OSV
added 4 days ago5 views

PYSEC-2026-3631 Keras: Lambda deserialization can bypass safe mode and execute code

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

8.8CVSS6.2AI score0.00467EPSS
SaveExploits1References11
PyPA
PyPA
added 4 days ago7 views

Keras: Lambda deserialization can bypass safe mode and execute code

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

9.8CVSS8.7AI score0.00467EPSS
SaveExploits1References11Affected Software1
OSV
OSV
added 4 days ago5 views

PYSEC-2026-3640 Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Summary DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user's chat id could therefore abort that user's running model response, title generation or tag generation. The deletio...

3.1CVSS5.5AI score0.00244EPSS
SaveExploits0References8
EUVD
EUVD
added 4 days ago9 views

EUVD-2026-55224

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

7.5CVSS5.4AI score0.00347EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 4 days ago7 views

CVE-2026-72582 fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

7.5CVSS5.4AI score0.00347EPSS
SaveExploits0References2
OSV
OSV
added 4 days ago3 views

CVE-2026-72582 fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

7.5CVSS5.5AI score
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 4 days ago9 views

CVE-2026-72582

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

7.5CVSS5.4AI score0.00347EPSS
SaveExploits0References3
Cvelist
Cvelist
added 4 days ago33 views

CVE-2026-72582 fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

7.5CVSS0.00347EPSS
SaveExploits0References2
CVE
CVE
added 4 days ago24 views

CVE-2026-72582

CVE-2026-72582 affects fastschema up to v0.15.1, where a NULL pointer dereference in the sendOTPEmail function (pkg/auth/local.go) dereferences an unchecked error pointer, causing a fatal panic and server crash on a single HTTP request to /api/auth/local/recover. Impact is unauthenticated DoS wit...

7.5CVSS5.4AI score0.00347EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 4 days ago4 views

kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

8.8CVSS6.6AI score0.00352EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 4 days ago4 views

kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

A flaw was found in the Linux kernel. Specifically, within the drm/xe graphics driver, two error handling issues in the xeexecqueuecreateioctl function could lead to memory corruption. This could result in a dangling pointer or a use-after-free vulnerability. A local attacker could potentially...

7.8CVSS5.4AI score0.00143EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 4 days ago3 views

kernel: ipc: limit next_id allocation to the valid ID range

A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...

7.8CVSS5.3AI score0.00134EPSS
SaveExploits0References5
IBM Security Bulletins
IBM Security Bulletins
added 4 days ago8 views

Security Bulletin:Vulnerability in GNU affects IBM Netezza Appliance

Summary The GNU package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2025-11083 Vulnerability Details CVEID:CVE-2025-11083 DESCRIPTION: A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elfswapshdr in the...

7.8CVSS5.8AI score0.00235EPSS
SaveExploits1Affected Software1
Cvelist
Cvelist
added 4 days ago33 views

CVE-2026-66485 Uncontrolled Memory Allocation in GNU cpio

GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...

4.6CVSS0.00132EPSS
SaveExploits0References2
Rows per page
Query Builder