184 matches found
PT-2026-105224
Security vulnerability affects the qdrant package. nanoid Nano ID before 5...
PT-2026-105230
Security vulnerability affects the qdrant package. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript...
PT-2026-105247
Security vulnerability affects the qdrant package. js-yaml is a JavaScript YAML parser and dumper...
PT-2026-105255
Security vulnerability affects the qdrant package. nanoid Nano ID before 3...
PT-2026-105257
Security vulnerability affects the qdrant package. baseline-browser-mapping 2...
CLEANSTART-2026-QW59159 Security fix for ghsa-8v2v-wjwg-vx6r applied in: qdrant 1.16.3-r0
Security vulnerability affects the qdrant package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101513
Security vulnerability affects the qdrant package. This issue is resolved in later releases. See references for vulnerability details...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the knowledge base delete handler process. An attacker can remove instance-wide configuration managed by administrators by sending a DELETE request to the relevant API endpoint with...
PYSEC-2026-3866 nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
SummaryThe POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to Qdran...
SUSE CVE-2026-11479
A vulnerability has been found in yoanbernabeu grepai 0.35.0. This issue affects some unknown processing of the file indexer/chunker.go of the component Qdrant Backend. Such manipulation leads to use of weak hash. The attack may be performed from remote. Attacks of this nature are highly complex...
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...
GHSA-8VH3-G2QG-2H2C nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...
CVE-2026-55640
Nextcloud MCP Server prior to 0.117.2 contains an authentication bypass in the POST /webhooks/nextcloud endpoint. The WEBHOOK_SECRET defaults to None and startup validation does not enforce it, allowing unauthenticated requests to handle_nextcloud_webhook(). The payload["user"]["uid"] field is at...
CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
CVE-2026-55640: Missing Authentication for Critical Function
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
GO-2025-3678 vulnerabilities
Vulnerabilities for packages: zizmor, atuin, lychee, parseable, rustls-ffi, linkerd-extension-init, zola, wash, sdp-k8s-injector, rye, xh, shadowsocks-rust, tealdeer, uv, wadm, zed, sqlx, wasmtime, pixi, kdash, samply, rustup, sccache, deno, cargo-audit, oranda, ntpd-rs, buck2, wasmcloud,...
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...
GHSA-FR6G-7CQ8-FG82 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...