Lucene search
+L

1620553 matches found

CVE
CVE
added 2026/09/09 9:00 p.m.4 views

CVE-2026-87013

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...

4.3CVSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/09 8:57 p.m.5 views

CVE-2026-87012 Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/openwebui/models/calendar.py stored the calendar event meta.alertminutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An...

4.3CVSS
SaveExploits0References4
CVE
CVE
added 2026/09/09 8:57 p.m.4 views

CVE-2026-87012

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/openwebui/models/calendar.py stored the calendar event meta.alertminutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An...

4.3CVSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/09 8:54 p.m.4 views

CVE-2026-87011 Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...

7.5CVSS
SaveExploits0References3
CVE
CVE
added 2026/09/09 8:54 p.m.4 views

CVE-2026-87011

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...

7.5CVSS
SaveExploits0References3
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/09 8:52 p.m.2 views

Security Bulletin: HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-68945 DESCRIPTION: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins...

8.8CVSS0.00122EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/09 8:51 p.m.1 views

Security Bulletin: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-15157 DESCRIPTION: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before...

6.5CVSS0.00193EPSS
SaveExploits0Affected Software1
Cvelist
Cvelist
added 2026/09/09 8:47 p.m.4 views

CVE-2026-53956 Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

5.4CVSS0.00033EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/09 8:47 p.m.40 views

CVE-2026-53956

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

5.4CVSS0.00033EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/09 8:36 p.m.8 views

CVE-2021-25374_Samsung-Account-Access

CVE-2021-25374 - Samsung Account Access Script This script can be used to gain access to a victim's Samsung Account if they have a specific version of Samsung Members installed on their Samsung Device, and if the victim's device is from the US or Korea region. How to use this script: 1. Host a we...

8.6CVSS7.4AI score0.03072EPSS
SaveExploits0
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/09 8:35 p.m.1 views

Security Bulletin: middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags.

Summary Upgrade to InformixHQ 3.3.2 included in 14.10.14W1 and 15.0.1.16 Vulnerability Details CVEID:CVE-2026-71848 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithm...

5.3CVSS0.00291EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/09 8:31 p.m.1 views

Security Bulletin: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-69192 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATW...

7.7CVSS0.00366EPSS
SaveExploits0Affected Software1
CVE
CVE
added 2026/09/09 8:25 p.m.5 views

CVE-2026-50165

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

7.1CVSS0.00032EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/09 8:25 p.m.5 views

CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

7.1CVSS0.00032EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/09 8:25 p.m.3 views

EUVD-2026-75140

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

7.1CVSS0.00032EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/09 8:21 p.m.3 views

CVE-2026-87911

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

9.6CVSS
SaveExploits0References3
NVD
NVD
added 2026/09/09 8:20 p.m.3 views

CVE-2026-71616

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gfroutemediacompleteobject. Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab...

SaveExploits0References2
NVD
NVD
added 2026/09/09 8:20 p.m.4 views

CVE-2026-71614

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/mediatools/dvbmpe.c, descriptorTimeslicefecidentifier and gfm2tsipdatagramreader components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938...

SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/09 8:20 p.m.1 views

Security Bulletin: brace-expansion is vulnerable to denial of service.

Summary Upgrade to InformixHQ 3.3.2 InformixHQ 3.3.2 is included in 14.10.14W1 and 15.0.1.16 Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of...

8.7CVSS0.00623EPSS
SaveExploits1Affected Software1
NVD
NVD
added 2026/09/09 8:18 p.m.3 views

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

4.2CVSS
SaveExploits0References4
Rows per page
Query Builder