989094 matches found
The vulnerability of the BGP OPEN message parser in the pkg/packet/bbg module of the edge gateway protocol GoBGP allows a attacker to compromise the integrity of the protected information.
The vulnerability of the BGP OPEN message parser in the pkg/packet/bbg module of the edge gateway protocol GoBGP is related to the execution of operations beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected...
The vulnerability of the DecodeFromBytes() function in the pkg/packet/bgp/bgp.go file of the BGP OPEN Message Handler component of the GoBGP protocol allows a attacker to increase their privileges.
The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/bgp.go file of the BGP OPEN Message Handler component is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...
FreeBSD : immich -- open redirect and reflected XSS in maintenance endpoint (fcc6baaa-adbc-11f1-a655-3497f65b111b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fcc6baaa-adbc-11f1-a655-3497f65b111b advisory. The immich project reports: The /maintenance endpoint fails to validate the continue URL parameter. Whe...
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...
GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization via the OAuth token exchange process. An attacker can retain unauthorized access to roles, including administrative privileges, by exchanging a valid provider access token even after t...
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...
EUVD-2026-75170
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout...
GHSA-3G9Q-V48F-HH9W Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...
Allocation of Resources Without Limits or Throttling
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the POST /oauth/backchannel-logout process in the OIDC back-channel logout handler when unauthenticated requests trigger repeated network fetches f...
GHSA-V39V-59XW-J98G Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value Summary Calendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object ...
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value Summary Calendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object ...
EUVD-2026-75171
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value...
Improper Validation of Specified Type of Input
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the meta object in calendar events, which is stored without validation. An attacker can disrupt calendar alert functionality for all users by submitting a...
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...
EUVD-2026-75172
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle...
Infinite loop
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Infinite loop through the POST /api/v1/folders/id/update/parent handler, which allows a folder to be moved under itself or one of its subfolders, creating a cycle in the folder hierarchy. An attacker can caus...
GHSA-8R35-5X5R-HV74 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...