10831 matches found
PT-2026-50592
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description Several direct, index-addressed Ollama proxy routes allow authenticated users to bypass backend isolation. The system accepts a caller-supplied url idx path parameter and uses it as a raw index in...
PT-2026-50538
Name of the Vulnerable Software and Affected Versions Tinyproxy versions prior to commit ff45d3b Description Tinyproxy fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine the number o...
Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenStack Keystone vulnerabilities (USN-8433-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8433-1 advisory. It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An...
nginx -- multiple vulnerabilities
The nginx developers report: A heap memory buffer overflow vulnerability when using the "ignoreinvalidheaders off;" and "largeclientheaderbuffers" directives with large configured values while proxying a specially crafted request to an HTTP/2 or gRPC backend may allow memory corruption or a...
PT-2026-50479
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description The chat message listener in the chat page's window message listener processes input:prompt and action:submit messages without enforcing same-origin restrictions. This allows an external site to s...
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
Summary rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: text /remote:path/object The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during...
CVE-2026-2604
Summary: CVE-2026-2604 affects evolution-data-server. An inconsistent comparison logic in the addressbook backend lets a Flatpak/D-Bus user craft a malicious URI with directory traversal sequences. This URI is stored during contact creation/modification and later rechecked with lower strictness d...
CVE-2026-2604
A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...
CVE-2026-54283 vulnerabilities
Vulnerabilities for packages: litellm, prefect-fips, airflow, mlflow, semgrep, tritonserver-backend-vllm-cuda-13.0, airflow-core, tritonserver-backend-vllm-cuda-12.9, nemo, prefect, airflow-postgres-fips, kserve, mlflow-fips...
CVE-2026-54282 vulnerabilities
Vulnerabilities for packages: litellm, prefect-fips, airflow, mlflow, semgrep, tritonserver-backend-vllm-cuda-13.0, airflow-core, tritonserver-backend-vllm-cuda-12.9, nemo, prefect, airflow-postgres-fips, kserve, mlflow-fips...
GHSA-JP82-JPQV-5VV3 vulnerabilities
Vulnerabilities for packages: litellm, prefect-fips, airflow, mlflow, semgrep, tritonserver-backend-vllm-cuda-13.0, airflow-core, tritonserver-backend-vllm-cuda-12.9, nemo, prefect, airflow-postgres-fips, kserve, mlflow-fips...
GHSA-82W8-QH3P-5JFQ vulnerabilities
Vulnerabilities for packages: litellm, prefect-fips, airflow, mlflow, semgrep, tritonserver-backend-vllm-cuda-13.0, airflow-core, tritonserver-backend-vllm-cuda-12.9, nemo, prefect, airflow-postgres-fips, kserve, mlflow-fips...
GHSA-63HW-FMQ6-XXG2 vulnerabilities
Vulnerabilities for packages: authentik-fips, py3-vllm-cuda-12.4, airflow-core, authentik, awx, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, request-1276, mlflow, metaflow-service-fips, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, airflow,...
CVE-2026-54275 vulnerabilities
Vulnerabilities for packages: authentik-fips, py3-vllm-cuda-12.4, airflow-core, authentik, awx, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, request-1276, mlflow, metaflow-service-fips, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, airflow,...
GHSA-2FQR-MR3J-6WP8 vulnerabilities
Vulnerabilities for packages: authentik-fips, py3-vllm-cuda-12.4, airflow-core, authentik, awx, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, request-1276, mlflow, metaflow-service-fips, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, airflow,...
GHSA-HPJ7-WQ8M-9HGP vulnerabilities
Vulnerabilities for packages: authentik-fips, py3-vllm-cuda-12.4, airflow-core, authentik, awx, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, request-1276, mlflow, metaflow-service-fips, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, airflow,...
GHSA-4M7W-QMGQ-4WJ5 vulnerabilities
Vulnerabilities for packages: authentik-fips, py3-vllm-cuda-12.4, airflow-core, authentik, awx, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, request-1276, mlflow, metaflow-service-fips, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, airflow,...
CVE-2026-54273 vulnerabilities
Vulnerabilities for packages: authentik-fips, py3-vllm-cuda-12.4, airflow-core, authentik, awx, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, request-1276, mlflow, metaflow-service-fips, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, airflow,...
CVE-2026-54274 vulnerabilities
Vulnerabilities for packages: authentik-fips, py3-vllm-cuda-12.4, airflow-core, authentik, awx, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, request-1276, mlflow, metaflow-service-fips, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, airflow,...
CVE-2026-54277 vulnerabilities
Vulnerabilities for packages: authentik-fips, py3-vllm-cuda-12.4, airflow-core, authentik, awx, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, request-1276, mlflow, metaflow-service-fips, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, airflow,...