open-webui (>=0.8.0, <=0.8.8) potentially affected by CVE-2026-61632 via pymdown-extensions (10.20.1)

pymdown-extensions PYPI version 10.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.8.0, =0.8.8 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

open-webui (>=0.7.0, <=0.7.2) potentially affected by CVE-2026-61632 via pymdown-extensions (10.20.0)

pymdown-extensions PYPI version 10.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.7.0, =0.7.2 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

GHSA-P5RM-JG5C-8C77 Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Impact Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics statictemplate or the adaptive-card extension x-ai-adaptive-card, the file reference is written into the generated manifest's...

EUVD-2026-44933

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by kiota info...

EUVD-2026-44937

Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...

akto v2.14.7

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...

Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator

Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled...

GHSA-XG2H-5XR2-29JW Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution Impact The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby...

GHSA-QQ9H-G4JM-XGF3 Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

Am I affected You are affected if all of the following hold: - You run a better-auth version below 1.6.22, or a 1.7.0-beta below 1.7.0-beta.10. - You enable the magic-link plugin or the email-OTP plugin. - You also enable email and password sign-up with open registration. - An account can exist a...

GHSA-H7F2-F9CC-H2GV ImageMagick: Memory Leak in YUV decoder when opening of blob fails

A memory leak will occur when a blob cannot be opened in the YUV decoder...

Ventoy v1.1.17

Ventoy Ventoy is an open source tool to create bootable USB drive for ISO/WIM/IMG/VHDx/EFI files. With Ventoy, you don't need to format the disk over and over, just copy the image files to the USB drive and boot them. You can copy many image files at a time and Ventoy will give you a boot menu to...

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's...

USN-8604-1 linux-azure-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

USN-8604-1: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

CVE-2026-63317

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

CVE-2026-15755

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15755

The CVE concerns the WordPress plugin Open User Map – Interactive Leaflet Maps (affected versions up to and including 1.4.45). It describes a Stored XSS via shortcode attributes caused by insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access ...

CVE-2026-15755

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-48506

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15755 Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...