CVE-2026-109284 Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint

Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/id/fork on chats th...

CVE-2026-103523

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...

CVE-2026-103523 CVE-2026-103523

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...

EUVD-2026-97476

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...

CVE-2026-103523

Thelia v2.6.0 is susceptible to an open redirect vulnerability within its address creation workflow. When a user submits the "Add New Address" form via a crafted URL, the application redirects the user to a destination specified in the next parameter. The vulnerability exists because the applicat...

CVE-2026-108950

Open Source Social Network OSSN through 10.1 contains a missing authorization vulnerability in ossnalbumpagehandler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos an...

EUVD-2026-97357

Open Source Social Network OSSN through 10.1 contains a missing authorization vulnerability in ossnalbumpagehandler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos an...

CVE-2026-108950 Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes

Open Source Social Network OSSN through 10.1 contains a missing authorization vulnerability in ossnalbumpagehandler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos an...

CVE-2026-108950 Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes

Open Source Social Network OSSN through 10.1 contains a missing authorization vulnerability in ossnalbumpagehandler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos an...

CVE-2026-108950

The Open Source Social Network (OSSN) version through 10.1 is vulnerable to a missing authorization flaw in the ossn_album_page_handler component. This security weakness allows unauthenticated attackers to bypass access controls and download private files, such as friends-only album photos and ot...

Apache Tomcat - Open Redirect

Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. id: CVE-2018-11784 info: name: Apache Tomcat - Open Redirect author: geeknik severity: medium description: | Apache Tomcat versions...

hsecscan

hsecscan Un escáner de seguridad para cabeceras de respuesta HTTP. Requisitos Python 2.x Módulos de Python os.path argparse sqlite3 urlparse urllib2 urllib json ssl Instalación $ pip install hsecscan Uso $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POS...

pi-hole

Bloqueo de anuncios en toda la red mediante tu propio hardware Linux Pi-hole® es un sumidero de DNS que protege tus dispositivos de contenido no deseado sin necesidad de instalar software en el cliente. Fácil de instalar : nuestros diálogos te guían a través del sencillo proceso de instalación en...

angr

angr angr es un marco de análisis binario independiente de la plataforma. Es presentado por el Computer Security Lab de UC Santa Barbara, SEFCOM en Arizona State University, su equipo CTF asociado, Shellphish, la comunidad de código abierto, y @rhelmot. Enlaces del proyecto Página principal:...

wazuh

Wazuh Wazuh es una plataforma gratuita y de código abierto utilizada para la prevención, detección y respuesta ante amenazas. Es capaz de proteger cargas de trabajo en entornos locales, virtualizados, en contenedores y en la nube. La solución Wazuh consta de un agente de seguridad de endpoint,...

CVE-2026-109285: Incorrect Authorization

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109291: Improper Neutralization of Input During Web Page Generation

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embedurl fields. Attackers can share a crafted chat whose citation, when clicked, is passed to...

EulerOS 2.0 SP11 : open-iscsi (EulerOS-SA-2026-4350)

According to the versions of the open-iscsi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A stack buffer overflow vulnerability exists in the idbmrecinfoconfig function in open-iscsi iscsi- initiator-utils. An attacker can craft a...

PT-2026-110603

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description An open redirect exists in the address creation workflow. When a user submits the Add New Address form via a crafted URL, the application redirects the user to the destination specified in the next parameter. T...

CVE-2024-58389: URL Redirection to Untrusted Site

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a nexturl cookie, so crafted login link...