CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

CVE-2025-30371

CVE-2025-30371 affects Metabase (self-hosted) prior to versions v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. The issue is a circumvention of local link access protection in the GeoJson endpoint, potentially impacting deployments where Metabase is colocated with other unsecured resources. Remedia...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner by an individual developer in Hayden, USA. A security vulnerability exists in Mealie v2.2.0 that stems from improper object-level authorization...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner by an individual developer in Hayden, USA. A security vulnerability exists in Mealie v2.2.0 that stems from improper object-level authorization...

Next.js Middleware Authorization Bypass Scanner

This module detects self-hosted Next.js applications affected by CVE-2025-29927, an authorization bypass in the middleware layer. Next.js tags its own internal subrequests with the x-middleware-subrequest header and skips middleware when it sees it. The header is trusted without verifying it...

编号撤回

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...

Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in Open WebUI version 0.3.8, which stems from the presence of stored cross-site scripting in the chat file upload function, which could lead to user...

编号撤回

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...

编号撤回

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...

Uptime Kuma 安全漏洞

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from the individual developer Louis Lam. A security vulnerability exists in Uptime Kuma 1.23.0 and prior versions that stems from a regular expression denial of service...

Security Bulletin: IBM Observability with Instana for Self-Hosted Standard Edition is affected by multiple Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana for Self-Hosted Standard Edition 291 CVE-2024-45337, CVE-2024-41110, CVE-2024-3596 Vulnerability Details CVEID:CVE-2024-45337 DESCRIPTION: Applications and libraries which misuse connection.serverAuthenticate via...

FileRise

FileRise !GitHub starshttps://img.shields.io/github/stars...

CVE-2025-25205 Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching

Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings lik...

Unspecified Vulnerability in coolLabs Coolify

Coolify is an open source and self-hosted alternative to Heroku/Netlify/Vercel. An unspecified vulnerability exists in coolLabs Coolify that originates from an authenticated user retrieving any existing private key on an instance in plain text. No detailed vulnerability details are provided at th...

CVE-2022-36065

GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the righ...

CVE-2024-57967

PVWA Password Vault Web Access in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mapping...

PT-2025-3075 · Cyberark · Cyberark Privileged Access Manager

Name of the Vulnerable Software and Affected Versions: CyberArk Privileged Access Manager Self-Hosted versions prior to 14.4 Description: The issue arises from inadequate handling of environment problems that can lead to Host header injection. This can potentially allow attackers to manipulate th...

CyberArk Privileged Access Manager Self-Hosted 安全漏洞

CyberArk Privileged Access Manager Self-Hosted is a privileged access self-hosted manager from CyberArk, Israel. A security vulnerability exists in CyberArk Privileged Access Manager Self-Hosted versions prior to 14.4, which stems from an environmental issue where password vault Web access is not...

PT-2025-3676 · Cyberark · Cyberark Privileged Access Manager

Name of the Vulnerable Software and Affected Versions: CyberArk Privileged Access Manager Self-Hosted versions prior to 14.4 Description: The issue concerns potentially elevated privileges in LDAP mapping. Recommendations: For versions prior to 14.4, update to version 14.4 or later to resolve the...

CyberArk Privileged Access Manager Self-Hosted 安全漏洞

CyberArk Privileged Access Manager Self-Hosted is a privileged access self-hosted manager from CyberArk, Israel. A security vulnerability exists in CyberArk Privileged Access Manager Self-Hosted versions prior to 14.4, which stems from a password vault Web access may elevate privileges in LDAP...