Lucene search
+L

21071 matches found

CVE
CVE
added 2026/05/16 3:25 p.m.26 views

CVE-2020-37235

CVE-2020-37235 concerns WordPress Theme Wibar 1.1.8, where a stored XSS flaw exists in the Brand component. The vulnerability allows authenticated users with editor/administrator/contributor/author roles to inject base64-encoded script payloads via the ftc_brand_url input field, resulting in arbi...

6.4CVSS5.9AI score0.00243EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/05/16 3:25 p.m.10 views

CVE-2020-37235

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject...

6.4CVSS5.9AI score0.00243EPSS
SaveExploits0References4Affected Software1
GithubExploit
GithubExploit
added 2026/05/16 2:53 p.m.109 views

Operation-Molasses

🍯 OPERATION MOLASSES PEKMEZ Zencefil Efendi's Cyber Dow...

6AI score
SaveExploits0
Veracode
Veracode
added 2026/05/16 5:33 a.m.19 views

Race Condition

Spring Cloud Config Server is vulnerable to Race Condition. The vulnerability is due to a Time-of-Check Time-of-Use TOCTOU issue in handling the Git repository base directory spring.cloud.config.server.git.basedir, where attackers may manipulate filesystem state between validation and use,...

8.1CVSS5.8AI score0.0022EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
added 2026/05/16 5:33 a.m.10 views

Path Traversal

github.com/go-git/go-billy is vulnerable to path traversal. The vulnerability is due to insufficient path sanitization and boundary enforcement across multiple components, which allows an attacker to use crafted paths such as .. to escape the intended base directory and access unintended filesyst...

8.1CVSS5.9AI score0.0031EPSS
SaveExploits0References4Affected Software1
NVD
NVD
added 2026/05/15 9:16 p.m.35 views

CVE-2026-45402

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied fileid and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the...

8.1CVSS0.00346EPSS
SaveExploits1References1
NVD
NVD
added 2026/05/15 9:16 p.m.29 views

CVE-2026-45398

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, validatecollectionaccess checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any...

7.5CVSS0.00331EPSS
SaveExploits1References3
OSV
OSV
added 2026/05/15 8:40 p.m.8 views

CVE-2026-45402 Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied fileid and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the...

8.1CVSS5.9AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/05/15 8:40 p.m.65 views

CVE-2026-45402 Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied fileid and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the...

8.1CVSS0.00346EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/05/15 8:40 p.m.18 views

EUVD-2026-30637

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied fileid and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the...

8.1CVSS5.8AI score0.00346EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/05/15 8:40 p.m.10 views

CVE-2026-45402

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied fileid and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the...

8.1CVSS5.8AI score0.00346EPSS
SaveExploits1References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/05/15 8:35 p.m.12 views

CVE-2026-45398 Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, validatecollectionaccess checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any...

7.5CVSS5.8AI score0.00331EPSS
SaveExploits1References3
EUVD
EUVD
added 2026/05/15 8:35 p.m.20 views

EUVD-2026-30634

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, validatecollectionaccess checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any...

7.5CVSS5.8AI score0.00331EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2026/05/15 8:35 p.m.9 views

CVE-2026-45398

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, validatecollectionaccess checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any...

7.5CVSS5.8AI score0.00331EPSS
SaveExploits1References4Affected Software1
Cvelist
Cvelist
added 2026/05/15 8:35 p.m.49 views

CVE-2026-45398 Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, validatecollectionaccess checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any...

7.5CVSS0.00331EPSS
SaveExploits1References3
OSV
OSV
added 2026/05/15 8:35 p.m.8 views

CVE-2026-45398 Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, validatecollectionaccess checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any...

7.5CVSS7.1AI score
SaveExploits0References5
NVD
NVD
added 2026/05/15 8:16 p.m.33 views

CVE-2026-45671

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user can permanently delete files owned by other users via DELETE /api/v1/files/id when the target file is referenced in any shared chat. The hasaccesstofile...

8CVSS0.0027EPSS
SaveExploits1References1
NVD
NVD
added 2026/05/15 8:16 p.m.31 views

CVE-2026-44555

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via basemodelid: a user-defined model e.g., "Cheap Assistant" can reference an existing base model e.g., "gpt-4-turbo-restricted" that provides...

7.6CVSS0.00248EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/05/15 7:57 p.m.15 views

CVE-2026-31223

The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability CWE-502 in the BaseLabeler.load method of the BaseLabeler class. The method loads serialized labeler models using the unsafe pickle.load function on user-supplied file paths without any validation or...

8.8CVSS6.5AI score0.00392EPSS
SaveExploits0References1
CVE
CVE
added 2026/05/15 7:49 p.m.49 views

CVE-2026-44554

Open WebUI (self-hosted AI) vulnerability: the POST /api/v1/retrieval/process/web endpoint accepts a user-controlled collection_name with overwrite defaulting to True, and performs no authorization check to verify write access. When overwrite is True, save_docs_to_vector_db calls VECTOR_DB_CLIENT...

8.1CVSS5.8AI score0.00295EPSS
SaveExploits1References1Affected Software1
Rows per page
Query Builder