PT-2026-89179

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.5.0 through 0.11.0 Description A flaw exists in the message-chain reconstruction helper located in backend/open webui/utils/misc.py. The system reconstructs chat history by map key but tracks visited entries using an...

Linux Distros Unpatched Vulnerability : CVE-2026-33604

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body t...

Linux Distros Unpatched Vulnerability : CVE-2026-40014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message...

Unity Linux 20.1070e Security Update: rubygem-websocket-driver (UTSA-2026-104957)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104957 advisory. Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the...

CVE-2026-18904

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

CVE-2026-18904

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Impact A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-value format, such as those generated by Fortigate devices. The vulnerability allows attackers to overwrite individual message fields, or to produce invalid messages which Graylog will...

GHSA-GQR6-R77P-C2PJ Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Impact A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-value format, such as those generated by Fortigate devices. The vulnerability allows attackers to overwrite individual message fields, or to produce invalid messages which Graylog will...

EUVD-2026-68013

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and...

CVE-2026-55841 Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and...

CVE-2026-18904

IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by an authorization bypass (CWE-639) stemming from a namespace collision between user identifiers . The public flow metadata endpoint exposes the owner's user_id, which an unauthenticated attacker can reuse as a client_id to collide with...

CVE-2026-82284

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-82271

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users'...

CVE-2026-51376

An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache...

CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...

SUSE-SU-2026:3868-1 Security update for quagga

This update for quagga fixes the following issue: - CVE-2026-37458: missing input validation in the MPREACHNLRI component allows authenticated attackers to cause a DoS via a crafted UPDATE message bsc1263974...

EUVD-2026-67815

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-82284

Quivr versions through 0.0.322 contain a missing ownership validation flaw in three chat API endpoints: GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer. An authenticated attacker can leverage this to read other users' conversation histories (including...

CVE-2026-82284

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-82284 Quivr Chat Endpoints Missing Ownership Validation

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...