ECHO-23A2-4E16-CCB1

Bulletin has no description...

CGA-F9FC-5R6X-PQ57

Bulletin has no description...

CGA-G6MG-RQ24-MWH7

Bulletin has no description...

CGA-2C4P-P35Q-Q4R4

Bulletin has no description...

CGA-JCMC-PGP2-PR3H

Bulletin has no description...

CGA-QQ24-XF7H-5V86

Bulletin has no description...

CGA-P25H-382R-QW6W

Bulletin has no description...

CGA-2866-3FGM-WCHW

Bulletin has no description...

CGA-HR96-FH6R-H4M8

Bulletin has no description...

CGA-HJCX-67HR-W25Q

Bulletin has no description...

CGA-5WJ5-36CG-77V6

Bulletin has no description...

PT-2026-54787

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description An authenticated user with host-edit permissions can exploit a cross-tenant information disclosure flaw. The issue exists because the taxonomy scope controller method fails to properly valida...

PT-2026-54776

Name of the Vulnerable Software and Affected Versions oras-go versions prior to 2.6.0 Description During the monolithic blob upload flow, the software follows a registry-controlled Location header and reuses the Authorization header from the initial POST request for the subsequent PUT request. If...

CVE-2026-56399 Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentiall...

CVE-2026-56399 Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentiall...

CVE-2026-56399 Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentiall...

MINI-VF4P-PJFW-FH39

Bulletin has no description...

MINI-XQC6-JC9R-67VQ

Bulletin has no description...

CVE-2026-11589

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript such as HTML or SVG to a publicly accessible location, leading to Stored Cross-Site Scripting attac...

CVE-2026-56399: Server-Side Request Forgery (SSRF)

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentiall...