Linux Distros Unpatched Vulnerability : CVE-2026-26197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's siz...

Linux Distros Unpatched Vulnerability : CVE-2026-64356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfsdqinodemetadircreate If xfsmetadircreate fails in...

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Summary Oh My Posh renders dynamic, potentially attacker-controlled strings the current directory name, Git commit metadata, environment variable values, command output into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject...

Incorrect Authorization

Overview vantage6 is a vantage6 command line interface Affected versions of this package are vulnerable to Incorrect Authorization due to missing ownership checks in the edit process. An attacker can modify another developer's algorithm metadata, such as updating the image or image tag, by...

GHSA-47W6-GWP4-W6VC vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review Patches No Workarounds No...

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

Summary hubuumclient diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models. Affected behavior Native reqwest::Error values retain the full request URL. Converting those errors into...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the uploadUrl function when processing attachment column values during AI table generation. An attacker can access internal network resources and sensitive...

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase: SSRF via bare fetch in uploadUrl during AI table generation Summary The uploadUrl function in packages/server/src/utilities/fileUtils.ts uses a bare fetchurl call without any SSRF protection. This function is invoked when the AI table generation feature processes LLM-generated attachmen...

Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the metadata endpoints, which fail to sanitize sensitive fields from user profiles. An attacker can obtain OAuth2 access and refresh tokens belonging to other users by...

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Summary The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users OIDC, Google, the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity...

GHSA-FCRW-F7GG-6G9F Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Summary The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users OIDC, Google, the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity...

EUVD-2026-42634

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete...

GHSA-2XWM-4H2Q-GGFX Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

Summary Current main and v0.9.6 still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model. This is an incomplete-fix variant of GHSA-vjqm-6gcc-62cr. The current fix adds...

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...

EUVD-2026-42368

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output...

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Summary If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut...

GHSA-6V4J-43GG-VJ32 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Summary If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut...

EUVD-2026-48742

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...

GO-2026-5666 Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm

Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the processuploadedfile process. An attacker can modify the file membership of a knowledge base without proper authorization by supplying a crafted metadata.knowledgeid value during...