21399 matches found
MINI-GMR9-9QJ8-Q7PG
Bulletin has no description...
MINI-XV97-6F42-M547
Bulletin has no description...
MINI-V646-454J-MFWC
Bulletin has no description...
MINI-JWF3-38WQ-VRJP
Bulletin has no description...
MINI-MGXJ-7546-CXHQ
Bulletin has no description...
MINI-5R3H-V7V6-V8FQ
Bulletin has no description...
MINI-4624-8HPG-RCJ5
Bulletin has no description...
MINI-767R-9MHJ-HRPP
Bulletin has no description...
MINI-M4RQ-GH8P-22G5
Bulletin has no description...
MINI-7H2P-GJ9F-4VP9
Bulletin has no description...
MINI-2QC4-M2QW-8HC6
Bulletin has no description...
Improper Access Control
getgrav/grav-plugin-api is vulnerable to Improper Access Control. The vulnerability is due to an insecure direct object reference and flawed permission update logic in UsersController::update, which allows an attacker to escalate privileges to Super Administrator and gain full system access...
Server-Side Request Forgery (SSRF)
FrontMCP is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to unsafe dereferencing of $ref pointers in OpenAPI specifications without URL restrictions, which allows an attacker to trigger requests to internal network resources or read local files through malicious OpenAP...
CVE-2026-44504
Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated attacker, given another user's threadid, can execute graph runs against the user's thread, read the user's full...
CVE-2026-44551
creationtimestamp| type| source ---|---|--- 2026-05-15 21:55:17+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mlwd4e4gaz2f 2026-05-16 11:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxozn5c3m2n 2026-05-18 20:07:20+00:00| seen|...
CVE-2026-45385
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, an IDOR vulnerability exists in the Channels feature of Open WebUI, allowing any channel member to modify messages sent by other members including administrators within the same...
CVE-2026-45666 Open WebUI: Indirect Object Reference (IDOR) in user notes
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the API /api/v1/notes/noteid endpoint lacks proper authorization checks, allowing authenticated users to retrieve notes belonging to other users by guessing or enumerating UUIDs. Th...
CVE-2026-45666 Open WebUI: Indirect Object Reference (IDOR) in user notes
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the API /api/v1/notes/noteid endpoint lacks proper authorization checks, allowing authenticated users to retrieve notes belonging to other users by guessing or enumerating UUIDs. Th...
CVE-2026-45666
CVE-2026-45666 — Open WebUI IDOR in notes endpoint : The API /api/v1/notes/{note_id} allowed authenticated users to read other users’ notes by guessing UUIDs prior to version 0.8.11, enabling unauthorized data disclosure. The issue is fixed in 0.8.11; per-id endpoints now enforce ownership (admin...
CGA-9FP4-3R9W-7WGX
Bulletin has no description...