53604 matches found
CVE-2026-70481 Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access i...
CVE-2026-70475 Flowise: Missing Authorization on Execution Update Endpoint
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission middleware that protects other execution endpoints. Any authenticated use...
UBUNTU-CVE-2026-47781
PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...
CVE-2026-66300 SNOMED International Snowstorm reflected XSS
SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...
CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...
ROOT-APP-PYPI-CVE-2026-21226 CVE-2026-21226 in azure-core - Patched by Root
Root has patched CVE-2026-21226 in the azure-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48524 CVE-2026-48524 in PyJWT - Patched by Root
Root has patched CVE-2026-48524 in the PyJWT package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48523 CVE-2026-48523 in PyJWT - Patched by Root
Root has patched CVE-2026-48523 in the PyJWT package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-33532 CVE-2026-33532 in yaml - Patched by Root
Root has patched CVE-2026-33532 in the yaml package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-45296 CVE-2024-45296 in path-to-regexp - Patched by Root
Root has patched CVE-2024-45296 in the path-to-regexp package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-3517 CVE-2022-3517 in minimatch - Patched by Root
Root has patched CVE-2022-3517 in the minimatch package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-27795 CVE-2026-27795 in @langchain/community - Patched by Root
Root has patched CVE-2026-27795 in the @langchain/community package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-3449 CVE-2026-3449 in @tootallnate/once - Patched by Root
Root has patched CVE-2026-3449 in the @tootallnate/once package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-6X33-PW7P-HMPQ GHSA-6x33-pw7p-hmpq in http-proxy - Patched by Root
Root has patched GHSA-6x33-pw7p-hmpq in the http-proxy package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-25290 CVE-2025-25290 in @octokit/request - Patched by Root
Root has patched CVE-2025-25290 in the @octokit/request package for Root:npm. Multiple fixed versions available...
CLSA-2026-1785380980 TuxCare security update for guzzlehttp/guzzle (2 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 6.0.2-p4+tuxcare...
CLSA-2026-1785380882 TuxCare security update for guzzlehttp/guzzle (8 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 8 CVEs. Fixed in 6.5.8-p2+tuxcare...
CLSA-2026-1785380362 TuxCare security update for org.springframework.integration (1 CVE)
TuxCare rebuilt 43 org.springframework.integration packages to address 1 CVE. Fixed in 6.4.10-tuxcare.1...