990785 matches found
openwebui-token-tracking (0.1.7) potentially affected by CVE-2024-7041 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2024-7041 Source advisory: OSV:PYSEC-2026-1744...
open-webui Insecure Direct Object Reference (IDOR) vulnerability
An Insecure Direct Object Reference IDOR vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint http://0.0.0.0:3000/api/v1/memories/id/update, where the decentralization design is flawed, allowing attackers to edit other users' memories without...
open-webui allows enumeration of file names and traversal of directories by observing the error messages
An information disclosure vulnerability exists in open-webui version 0.3.8. The vulnerability is related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different error messages based on the existenc...
PYSEC-2026-1738 open-webui allows enumeration of file names and traversal of directories by observing the error messages
An information disclosure vulnerability exists in open-webui version 0.3.8. The vulnerability is related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different error messages based on the existenc...
PYSEC-2026-1744 open-webui Insecure Direct Object Reference (IDOR) vulnerability
An Insecure Direct Object Reference IDOR vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint http://0.0.0.0:3000/api/v1/memories/id/update, where the decentralization design is flawed, allowing attackers to edit other users' memories without...
open-interpreter (>=0.1.8, <=0.1.9), openplugin (>=0.0.25, <=0.0.27) potentially affected by CVE-2024-6587 via litellm (0.7.10)
litellm PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.8, =0.0.25, =0.0.27 Source cves: CVE-2024-6587 Source advisory: OSV:PYSEC-2026-1547...
bavisitter (>=0.0.0, <=0.1.0rc1), cosmoai (>=0.8.8, <=0.9.1.11) +1 more potentially affected by CVE-2024-6587 via litellm (0.13.0)
litellm PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - bavisitter =0.0.0, =0.8.8, =0.9.1.11 - open-interpreter 0.1.11 Source cves: CVE-2024-6587 Source advisory: OSV:PYSEC-2026-1547...
open-interpreter (>=0.1.12, <=0.1.17), promptmodel (>=0.0.25, <=0.0.31) potentially affected by CVE-2024-6587 via litellm (0.13.2)
litellm PYPI version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.12, =0.0.25, =0.0.31 Source cves: CVE-2024-6587 Source advisory: OSV:PYSEC-2026-1547...
Potential access to sensitive URLs via CKAN extensions (SSRF)
ImpactThere are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents e.g. pushing to the DataStore, streaming contents or saving a local cop...
MobSF vulnerable to Open Redirect in Login Redirect
ImpactWhat kind of vulnerability is it? Who is impacted?An open redirect vulnerability exist in MobSF authentication view. PoC1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.2. Enter credentials and press "Sign In".3. You will be redirected to afine.comUsers who are not...
PYSEC-2026-1669 MobSF vulnerable to Open Redirect in Login Redirect
Impact What kind of vulnerability is it? Who is impacted? An open redirect vulnerability exist in MobSF authentication view. PoC 1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser. 2. Enter credentials and press "Sign In". 3. You will be redirected to afine.com Users who are...
PYSEC-2026-1722 Open WebUI Stored Cross-Site Scripting Vulnerability
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page...
atxm (0.3.0), cli-progress (1.9.0) +7 more potentially affected by CVE-2024-41671 via twisted (24.3.0)
twisted PYPI version 24.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - atxm 0.3.0 - cli-progress 1.9.0 - ctrader-open-api =0.9.2, =0.2.8, =4.3.0, =7.3.0, =1.2.5, =0.3.0b0, =2.3.0rc39, =2.3.0rc40 Source cves:...
Open redirect in gradio
An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...
open-interpreter (>=0.1.12, <=0.1.17), promptmodel (>=0.0.25, <=0.0.31) potentially affected by CVE-2024-5710 via litellm (0.13.2)
litellm PYPI version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.12, =0.0.25, =0.0.31 Source cves: CVE-2024-5710 Source advisory: OSV:PYSEC-2026-1551...
fastrepl (>=0.0.21, <=0.0.25), funcflow (0.0.3) +2 more potentially affected by CVE-2024-5710 via litellm (0.8.6)
litellm PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl =0.0.21, =0.0.5, =0.0.9 Source cves: CVE-2024-5710 Source advisory: OSV:PYSEC-2026-1551...
open-interpreter (>=0.1.8, <=0.1.9), openplugin (>=0.0.25, <=0.0.27) potentially affected by CVE-2024-5710 via litellm (0.7.10)
litellm PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.8, =0.0.25, =0.0.27 Source cves: CVE-2024-5710 Source advisory: OSV:PYSEC-2026-1551...
PYSEC-2026-1414 Open redirect in gradio
An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...
fastrepl (>=0.0.21, <=0.0.25), funcflow (0.0.3) +2 more potentially affected by CVE-2024-4888 via litellm (0.8.6)
litellm PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl =0.0.21, =0.0.5, =0.0.9 Source cves: CVE-2024-4888 Source advisory: OSV:PYSEC-2026-1540...
open-interpreter (>=0.1.8, <=0.1.9), openplugin (>=0.0.25, <=0.0.27) potentially affected by CVE-2024-4888 via litellm (0.7.10)
litellm PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.8, =0.0.25, =0.0.27 Source cves: CVE-2024-4888 Source advisory: OSV:PYSEC-2026-1540...