PT-2026-76002

Summary The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj field of the API response. While a redactCredentialWithPasswordType function masks fields defined with type: 'password' in their component schema, many credential types store highly...

PT-2026-67884

Name of the Vulnerable Software and Affected Versions Ghost versions 0.10.0 through 6.54.0 Description A Server-Side Request Forgery SSRF exists in the Ghost Admin image fetching feature. This allows any user with staff-level privileges to execute blind HTTP GET requests against internal hosts...

PT-2026-67746

Name of the Vulnerable Software and Affected Versions OpenCode Studio versions prior to 2.4.4 Description Missing authentication allows remote attackers to read arbitrary files within the temp and static/music directories. This is achieved by accessing the 'GET /api/tmp/:tmpFile' and 'GET...

PT-2026-67820

Name of the Vulnerable Software and Affected Versions Atals-Livre affected versions not specified Description Atals-Livre contains a SQL injection flaw that allows attackers to manipulate database queries. This occurs when unsanitized input is passed through a GET parameter to the supp deletion...

CVE-2026-70591: Server-Side Request Forgery (SSRF)

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

CVE-2026-69252: Missing Authorization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CVE-2026-70480: Server-Side Request Forgery (SSRF)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such ...

CVE-2026-70473: Exposure of Sensitive Information to an Unauthorized Actor

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

CVE-2026-14838: Use of GET Request Method With Sensitive Query Strings

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

PT-2026-67833

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.34 through 0.10.x Description Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. This allows a user to place a...

PT-2026-67747

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An issue exists where the '/api/v1/files' endpoint is protected only by a feature gate and fails to enforce permission checks on GET and DELETE requests. This allows an authenticated user with a...

PT-2026-67931

Summary Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user's browser issue attacker-chosen outbound GET...

PT-2026-67844

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.0 Description An authenticated attacker can bypass URL validation to perform a DNS rebinding attack. The software validates hostnames by resolving them once to reject private, loopback, and link-local addresse...

PT-2026-67685

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

SUSE CVE-2026-62959

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...

CVE-2026-67617

CVE-2026-67617 (Microweber CMS 2.0.20) describes a stored XSS in the content tagging system. An admin-authenticated attacker can inject arbitrary JavaScript by submitting payloads to the tag_names parameter of the GET /api/save_content_admin endpoint. The vulnerability allegedly bypasses three sa...

CVE-2026-18648

Blix Email Blue Mail Calendar App 2.2.305 is affected by a path traversal in the component react-native-receive-sharing-intent, specifically FileDirectory.getDataColumn/FileDirectory.getFileFromUri. The vulnerability arises from manipulating the _display_name argument, enabling local access explo...

CVE-2026-18648 Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...

CVE-2026-18648

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...

EUVD-2026-52427

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...