CVE-2026-12061 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59936 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-55H5-XMCQ-C37V vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-FG7F-2386-8897 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59935 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-5XF7-4P34-54QR vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-44763

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on condition...

EUVD-2025-210676

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

EUVD-2026-55863

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on condition...

SUSE CVE-2026-15059

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

PT-2026-70236

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata file...

PT-2026-70870

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where a compromised managed cluster, known as a spoke, can inject unencoded data into the Insights API URL path. This happens because the ClusterID variable, which is...

PT-2026-70337

Name of the Vulnerable Software and Affected Versions gaudi-container-runtime versions prior to 1.24.0 Description A path traversal issue exists within Ring 3: User Applications, which may allow an authenticated, unprivileged software adversary to escalate privileges. This can occur via local...

PT-2026-70196

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

PT-2026-70875

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in...

VulnCheck KEV: CVE-2026-33497

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the downloadprofilepicture function of the /profilepictures/foldername/filename endpoint, the foldername and filename parameters are not strictly filtered, which allows the secretkey to be re...

PT-2026-70148

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file pa...

PT-2026-70695

Name of the Vulnerable Software and Affected Versions .NET Framework affected versions not specified Description A relative path traversal issue allows an unauthorized attacker to elevate privileges locally on the system. Recommendations At the moment, there is no information about a newer versio...

PT-2026-70146

Name of the Vulnerable Software and Affected Versions AsyncFuncAI deepwiki-open versions prior to commit 16f35a0 Description A path traversal issue allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths. This occurs via the 'local-repository structure'...

PT-2026-70214

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU7 Description An issue in the Core of the software allows a remote authenticated attacker to gain full write control over an S3 bucket used for session recording storage. This is caused by...