137715 matches found
GHSA-F45Q-W629-WR25 Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects
Impact The built-in async and blocking clients used reqwest's default redirect policy. BaseUrl constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on...
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
Summary @anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned up, even...
GHSA-G5VV-Q72C-7J78 @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
Summary @anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned up, even...
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
Summary pheditor's terminal feature restricts callers to an allowlist of commands TERMINALCOMMANDS and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their ow...
GHSA-G3HQ-HPHG-8FHH Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
Summary pheditor's terminal feature restricts callers to an allowlist of commands TERMINALCOMMANDS and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their ow...
GHSA-V42F-V8XC-J435 Budibase: SSRF via DNS rebinding in the REST datasource integration
Summary Budibase's central outbound-fetch guard fetchWithBlacklist prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and pinning the connection to the validated IP. The pin is implemented as a Node https.Agent makePinnedAgent. The fix...
Budibase: SSRF via DNS rebinding in the REST datasource integration
Summary Budibase's central outbound-fetch guard fetchWithBlacklist prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and pinning the connection to the validated IP. The pin is implemented as a Node https.Agent makePinnedAgent. The fix...
GHSA-MQHR-6J6H-74P5 Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
Summary Budibase attaches a REST datasource's stored credentials Bearer/Basic tokens and static headers to an outgoing request before it decides which host the request goes to, and never checks that the destination host matches the datasource. A query's request path can be pointed at any host via...
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
Summary Budibase attaches a REST datasource's stored credentials Bearer/Basic tokens and static headers to an outgoing request before it decides which host the request goes to, and never checks that the destination host matches the datasource. A query's request path can be pointed at any host via...
GHSA-4QCJ-M5WP-JMF4 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...
Budibase: Privilege escalation via public role assignment API missing app-level authorization
Summary Budibase 3.39.19 commit 03fbabae4 is affected by a privilege-escalation / missing-authorization flaw in the public role-assignment API. An app-scoped builder a user who builds only specific apps — user.builder.apps = appA, not a global builder or admin can grant themselves builder access ...
GHSA-J9FC-W3MR-X6MV Budibase: Privilege escalation via public role assignment API missing app-level authorization
Summary Budibase 3.39.19 commit 03fbabae4 is affected by a privilege-escalation / missing-authorization flaw in the public role-assignment API. An app-scoped builder a user who builds only specific apps — user.builder.apps = appA, not a global builder or admin can grant themselves builder access ...
GHSA-FRVJ-C5QP-XJ4W open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...
GHSA-2XWM-4H2Q-GGFX Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Summary Current main and v0.9.6 still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model. This is an incomplete-fix variant of GHSA-vjqm-6gcc-62cr. The current fix adds...
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Summary Current main and v0.9.6 still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model. This is an incomplete-fix variant of GHSA-vjqm-6gcc-62cr. The current fix adds...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in HuggingFace Transformers [CVE-2026-1839]
Summary IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in HuggingFace Transformers, due to a flaw in the Trainer class, that allows for arbitrary code execution CVE-2026-1839. HuggingFace Transformers is used in our speech runtimes. This vulnerabilitiy has been...
Security Bulletin: Security Vulnerability in Eclipse Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-1605)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Eclipse Jetty Vulnerability Details CVEID:CVE-2026-1605 DESCRIPTION: In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP...
Security Bulletin: SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-7769)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to SQL injection. Vulnerability Details CVEID:CVE-2026-7769 DESCRIPTION: IBM Sterling File Gateway is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, whic...