CVE-2026-13227 ERPNext v16.25.0 - Improper authorization in Prospect opportunities API

An Improper Authorization vulnerability exists in ERPNext version v16.25.0 and 15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0...

EUVD-2026-52922

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

EUVD-2026-52898

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

CVE-2026-18812

The CVE-2026-18812 entry concerns H3C NX15 V100R017. The affected component is esps.ipv6.wan in the /api/esps path. The root cause is manipulation of the argument workMode, enabling command injection. Exploitation is possible remotely, with a published exploit. The CVE documents do not provide re...

CVE-2026-18812

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

CVE-2026-14643 vulnerabilities

Vulnerabilities for packages: code-server, kibana, renovate, pelias-api, langfuse-fips, langfuse, vitess...

GHSA-JR45-8VMC-QM54 vulnerabilities

Vulnerabilities for packages: code-server, kibana, renovate, pelias-api, langfuse-fips, langfuse, vitess...

CVE-2026-69153 vulnerabilities

Vulnerabilities for packages: cadence-web, authentik-fips, authentik, keep-fips, renovate, saf, arangodb, gitlab-rails-ce-fips, pelias-api, langfuse-fips, vitess, kubeflow-pipelines, nextcloud-server, langfuse, gitlab-rails-ce, keep, semaphore...

GHSA-FXQJ-RQCC-2CMP vulnerabilities

Vulnerabilities for packages: cadence-web, authentik-fips, authentik, keep-fips, renovate, saf, arangodb, gitlab-rails-ce-fips, pelias-api, langfuse-fips, vitess, kubeflow-pipelines, nextcloud-server, langfuse, gitlab-rails-ce, keep, semaphore...

GHSA-RGW5-RVV9-X895 vulnerabilities

Vulnerabilities for packages: actions-runner, azurite, pulumi, opentelemetry-auto-instrumentations-node, arangodb, prism, opensearch-dashboards-fips, redisinsight, graalvm, npm, pelias-api, kubeflow-katib, gemini-cli, rancher-api-ui, vitess, authentik, renovate, wazuh-dashboard-fips, langfuse-fip...

CVE-2026-69152 vulnerabilities

Vulnerabilities for packages: actions-runner, azurite, pulumi, opentelemetry-auto-instrumentations-node, arangodb, prism, opensearch-dashboards-fips, redisinsight, graalvm, npm, pelias-api, kubeflow-katib, gemini-cli, rancher-api-ui, vitess, authentik, renovate, wazuh-dashboard-fips, langfuse-fip...

GHSA-RGW5-RVV9-X895 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, langfuse, prism, sqlpad, nextcloud-server, rancher-api-ui, renovate, argo-workflows, pulumi, opensearch-dashboards, ts-patch, serve, saf, npm...

CVE-2026-70483

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...

CVE-2026-18811 H3C NX15 esps add command injection

A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The...

EUVD-2026-52896

A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The...

CVE-2026-18810

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

EUVD-2026-52891

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

CVE-2026-70484

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied imagegeneration flag and did not re-check the features.imagegeneration permission that the direct image routes and...

CVE-2026-70483

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the updatemessagebyid and deletemessagebyid handlers when processing standard channels due to insufficient authorization checks. An attacker can modify or delete messages authored by...