11415 matches found
CVE-2026-70487 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file i...
Malicious code in @umacloud/knowledge (npm)
npm/@umacloud/knowledge is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...
Malicious code in @or-sdk/knowledge-models (npm)
npm/@or-sdk/knowledge-models is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
CVE-2026-15241
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
CVE-2026-15241
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
EUVD-2026-51934
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
CVE-2026-15241 ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
CVE-2026-15241
The CVE-2026-15241 affects the AI ChatBot for WooCommerce WordPress plugin prior to 4.8.4. It lacks authorization/nonce checks on an AJAX action, enabling unauthenticated users to abuse the site owner’s stored third‑party API key to send requests billed to the owner and, if enabled, retrieve inde...
GHSA-2XWM-4H2Q-GGFX Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Summary Current main and v0.9.6 still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model. This is an incomplete-fix variant of GHSA-vjqm-6gcc-62cr. The current fix adds...
EUVD-2026-42634
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete...
EUVD-2026-42628
Open WebUI: Upload metadata.knowledgeid bypasses the knowledge-base write-access check read-only users can add files to KB...
GHSA-7R7X-GJVR-448G Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...
EUVD-2026-48124
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65522
The CVE-2026-65522 entry documents a Cross Site Scripting (XSS) vulnerability in the WordPress Manual theme (Documentation, Knowledge Base & Education WordPress Theme) up to version 7.5.4. The description specifies XSS in versions
EUVD-2026-48117
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
EUVD-2026-47448
Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Knowledge...
EUVD-2026-47141
Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite component: Search. Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management...
CVE-2026-61261
Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Knowledge...
CVE-2026-60842
Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite component: Search. Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management...
