1991 matches found
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Summary Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event SSE execute events. This leads to authentication token theft, comple...
CVE-2025-62038
Insertion of Sensitive Information Into Sent Data vulnerability in Sovlix MeetingHub meetinghub allows Retrieve Embedded Sensitive Data.This issue affects MeetingHub: from n/a through = 1.23.9...
PT-2025-45528
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.224 and prior Open WebUI versions 0.6.34 and prior Open WebUI version 0.6.33 and prior Description Open WebUI, a self-hosted artificial intelligence platform, contains a code injection vulnerability within the Direct...
EUVD-2025-38127
Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through = 4.2...
CVE-2025-60188 WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through = 4.2.1...
PT-2025-45305
Insertion of Sensitive Information Into Sent Data vulnerability in Sovlix MeetingHub meetinghub allows Retrieve Embedded Sensitive Data.This issue affects MeetingHub: from n/a through = 1.23.9...
WordPress Plugin Rank Math SEO Information Leakage Vulnerability
WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin Rank Math SEO.The...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989027)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989027 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas...
CVE-2025-62947
Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publitio: from n/a through = 2.2.5...
CVE-2025-62947
Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publitio: from n/a through = 2.2.5...
PT-2025-43774
Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through = 4.2...
PT-2025-43823
Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publitio: from n/a through = 2.2.3...
WordPress AppExperts plugin information disclosure vulnerability
WordPress AppExperts plugin is a plugin for converting WordPress websites to iOS and Android mobile apps, with support for converting WooCommerce e-commerce platform features. WordPress AppExperts plugin suffers from an information disclosure vulnerability that originates from the insertion of...
GO-2025-3986 vet MCP Server SSE Transport DNS Rebinding Vulnerability in github.com/safedep/vet
vet MCP Server SSE Transport DNS Rebinding Vulnerability in github.com/safedep/vet...
CVE-2025-62026 WordPress Blockspare plugin <= 3.2.13.2 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Blockspare Blockspare blockspare allows Retrieve Embedded Sensitive Data.This issue affects Blockspare: from n/a through = 3.2.13.2...
CVE-2025-53218
CVE-2025-53218 describes an information disclosure in the WordPress plugin AppExperts (versions <= 1.4.5). The root cause is the insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. Affected software: AppExperts – Mobile App Builder for WordPress | ...
PT-2025-43251
Name of the Vulnerable Software and Affected Versions WP Gmail SMTP versions through 1.0.7 Description The WP Gmail SMTP plugin contains a flaw that allows the retrieval of embedded sensitive data. This issue relates to the insertion of sensitive information into sent data. Recommendations Update...
CVE-2025-6515 Reuse of session IDs in oatpp-mcp leads to session hijacking and prompt hijacking by remote attackers
The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses...
PT-2025-42788
Name of the Vulnerable Software and Affected Versions oatpp-mcp affected versions not specified Description The MCP SSE endpoint returns an instance pointer as the session ID, which is not unique or cryptographically secure. This allows network attackers with access to the oatpp-mcp server to gue...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987330)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987330 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: Fix a data-race around sysctltcpnotsentlowat. While reading sysctltcpnotsentlowat, it can be...