CVE-2026-85704

A race condition in the getJailbreak function of server/config.py within the Jailbreak Mode component of ramon-victor freegpt-webui (affects builds up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc) allows a remote, unauthenticated attacker to cause a low availability impact . The attack requ...

CVE-2026-85704 ramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race condition

A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server/config.py of the component Jailbreak Mode. The manipulation results in race condition. It is possible to launch the...

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

CVE: This vulnerability corresponds to CVE-2026-72798. Summary renderAttributeView correctly applies the reader publish-access filter, but the filter's row-accessibility decision is keyed solely to the row's first cell, and it never inspects the remaining cells' values. Relation and Rollup cells...

GHSA-MFRJ-V65R-979C SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

CVE: This vulnerability corresponds to CVE-2026-72798. Summary renderAttributeView correctly applies the reader publish-access filter, but the filter's row-accessibility decision is keyed solely to the row's first cell, and it never inspects the remaining cells' values. Relation and Rollup cells...

CVE-2026-57160

A flaw was found in PJSIP, a multimedia communication library, where a buffer overflow can occur in the pjsipgenericarrayhdrprint function. This vulnerability arises during the serialization of Session Initiation Protocol SIP message headers, allowing a remote attacker to write one byte past the...

SurrealDB: Writes in a PERMISSIONS clause bypass table permissions

A PERMISSIONS ... WHERE clause is evaluated with permission enforcement disabled, so it can't recurse into its own checks. But the clause could also contain data-modifying statements, and these ran with enforcement still off — so evaluating a permission check could write to tables the caller cann...

GHSA-66R2-5GWJ-GXM2 SurrealDB: Writes in a PERMISSIONS clause bypass table permissions

A PERMISSIONS ... WHERE clause is evaluated with permission enforcement disabled, so it can't recurse into its own checks. But the clause could also contain data-modifying statements, and these ran with enforcement still off — so evaluating a permission check could write to tables the caller cann...

EUVD-2026-71751

A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...

CVE-2026-85703

ramon-victor freegpt-webui (up to commit 098db3dfeb) is vulnerable to an allocation of resources flaw in the Jailbreak Mode component, specifically in the getJailbreak function of server/backend.py. The attack is remote , requires no authentication , and has low complexity . Impact is rated MEDIU...

CVE-2026-85703 ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources

A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...

CVE-2026-8054

1. 漏洞概述 CVE-2026-8054 是一个存在于 dotCMS Core 发布审计 API（Publish Audit API）中的高危前台无需认证 SQL 注入漏洞 （Pre-auth SQL Injection）。该漏洞由官方追踪为安全事件 SI-75 ，并于 2026 年 5 月底被正式收录披露。由于攻击者无需任何账号权限即可远程触发，其潜在危害非常严重。 属性| 值 ---|--- CVE编号| CVE-2026-8054 官方追踪| SI-75 漏洞类型| SQL注入 CWE-89 影响组件| dotCMS Core - Publish Audit API CVSS评分...

CVE-2021-41773-POC

CVE-2021-41773 Vulnerability Reproduction Report Vulnerability Overview CVE ID : CVE-2021-41773 Vulnerability Name : Apache HTTP Server Path Traversal Vulnerability Risk Level : High CVSS 7.5 Affected Version : Apache HTTP Server 2.4.49 Vulnerability Description : Apache HTTP Server version 2.4.4...

CVE-2026-85702

A missing authentication vulnerability exists in the _conversation function of server/backend.py (Backend Conversation API) in ramon-victor freegpt-webui , affecting commits up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Remote attackers can manipulate the model argument to bypass authentication...

CVE-2026-85702 ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

EUVD-2026-71750

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

CVE-2026-85643

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

EUVD-2026-71749

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

CVE-2026-85701

ramon-victor freegpt-webui (up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc ) is affected by a missing authentication flaw in the ChatCompletion.create function within g4f/init .py (component: Authentication Check). A remote attacker can manipulate this function without valid credentials, r...

CVE-2026-85701 ramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

GHSA-848M-R628-VRXW SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

An authenticated user scoped to one namespace/database could invoke a custom API DEFINE API belonging to a different namespace/database, reaching another tenant's endpoint. The route /api/namespace/database/endpoint took the namespace and database from the URL and applied them to the caller's...