CVE-2025-51869

CVE-2025-51869 Vulnerability description Liner is a reliable AI search engine with over 10 million users worldwide. Liner construct a search engine based on LLM, which is vulnerable to Insecure Direct Object Reference IDOR in its chat component. An attacker can exploit this IDOR to tamper other...

DEBIAN-CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

EUVD-2026-107702

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2026-114725

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a mail header injection vulnerability. The root cause is that the rcmail_sendmail function only stripped newline characters from the Subject and Organization headers, leaving other header values taken from request p...

PT-2026-120957

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2025-51865

CVE-2025-51865 Vulnerability description Ai2 is a Seattle based non-profit AI research institute. Ai2 provide a playground web application to chat with their LLM, which is vulnerable to Insecure Direct Object Reference IDOR in its chat component. An attacker can exploit this IDOR to tamper other...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Added an array index check for hdcp ddc access. Reason Coverity reports an OVERRUN warning. Do not check if the array index is valid. How Check that the msgid is valid and that the array index is valid...

CVE-2026-103547

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can...

CVE-2026-103547

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can...

CVE-2026-95655

Aureus ERP before 1.5.0 contains an IDOR vulnerability in the ChatterPanel Livewire component (Webkul Chatter plugin). Message lookups are not scoped to the current record, allowing any authenticated user to submit sequential message IDs and read, edit, delete, or pin messages belonging to other ...

SUSE CVE-2026-67446

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-67446: Uncontrolled Resource Consumption

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

PYSEC-2026-3605 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through...

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the chat completion process. An attacker can overwrite messages in channels they do not belong to, including private and direct message channels, by supplying a crafted chatid an...

GHSA-X2FF-V5V8-M75M Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through...

SUSE CVE-2026-64034

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...