CVE-2026-12003

A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...

Astra Linux – Vulnerability in Thunderbird

The encrypted subject of an email message may be incorrectly and permanently assigned to another arbitrary email message in Thunderbird’s local cache. As a result, when replying to the contaminated email message, the user may accidentally expose the confidential subject to a third party. While th...

CVE-2026-81565

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

The vulnerability of the Compressed Folder tool in Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Compressed Folder tool in Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-70820

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

EUVD-2025-210899

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

CVE-2025-70820

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

CVE-2025-70820

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

CVE-2025-70820

Zettlab D6 Ultra (a NAS device) prior to firmware 1.7.0 is affected by an absolute path traversal vulnerability that allows an attacker with low privileges on an adjacent network to reach folders outside the user's personal folder, resulting in low confidentiality impact (CVSS 3.5, LOW). The reme...

PT-2026-90948

Name of the Vulnerable Software and Affected Versions Zettlab D6 Ultra versions prior to 1.7.0 Description An absolute path traversal issue exists, allowing access to directories outside of the designated personal folder. Recommendations Update Zettlab D6 Ultra to version 1.7.0 or later...

CVE-2026-54165: Improper Neutralization of Input During Web Page Generation

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

EUVD-2026-75172

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle...

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

GHSA-8R35-5X5R-HV74 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

EUVD-2026-75181

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions...

GHSA-3PF7-Q2G3-WJ28 Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Summary The chat-completions endpoint reads a folder id out of the request body and saves the newly created chat into that folder without checking that the caller is allowed to write there. Any authenticated user who knows a folder's id can put a chat of their own into another user's folder,...

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Summary The chat-completions endpoint reads a folder id out of the request body and saves the newly created chat into that folder without checking that the caller is allowed to write there. Any authenticated user who knows a folder's id can put a chat of their own into another user's folder,...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the chat-completions process. An attacker can insert unauthorized chat entries into another user's folder by supplying a folder ID they do not have write access to. This allows t...

CVE-2026-87997

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

CVE-2026-87997 Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...