308230 matches found
CVE-2026-70620 Odysseus SSRF via Embedding Endpoint Configuration
Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind...
CVE-2026-70620 Odysseus SSRF via Embedding Endpoint Configuration
Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind...
GHSA-3R7G-Q6CG-Q2VX Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...
CVE-2026-66901
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...
CVE-2026-66901 Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...
CVE-2026-66901
CVE-2026-66901 : Google::Auth for Perl before version 0.09 is prone to server-side request forgery and credential exfiltration due to unvalidated URLs sourced from the credentials JSON. The attack could reach hosts in the configuration’s network position (including internal services and metadata ...
Open WebUI: DNS Rebinding SSRF Bypass
Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...
CVE-2026-14643 vulnerabilities
Vulnerabilities for packages: code-server, langfuse-fips, langfuse, pelias-api, kibana, vitess, renovate...
GHSA-JR45-8VMC-QM54 vulnerabilities
Vulnerabilities for packages: code-server, langfuse-fips, langfuse, pelias-api, kibana, vitess, renovate...
CVE-2026-69153 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, keep-fips, saf, kubeflow-pipelines, pelias-api, authentik, langfuse-fips, langfuse, vitess, gitlab-rails-ce-fips, nextcloud-server, renovate, keep, authentik-fips, arangodb, cadence-web, semaphore...
GHSA-FXQJ-RQCC-2CMP vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, keep-fips, saf, kubeflow-pipelines, pelias-api, authentik, langfuse-fips, langfuse, vitess, gitlab-rails-ce-fips, nextcloud-server, renovate, keep, authentik-fips, arangodb, cadence-web, semaphore...
CVE-2026-18446 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, argo-workflows, opensearch-dashboards-fips, saf, langfuse-fips, opensearch-dashboards, prism, langfuse, vitess, gitlab-rails-ce-fips, gemini-cli, serve, nextcloud-server, unleash-proxy, arangodb, renovate, librechat, yaml-language-server...
GHSA-7P8R-X3MC-P8W7 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, argo-workflows, opensearch-dashboards-fips, saf, langfuse-fips, opensearch-dashboards, prism, langfuse, vitess, gitlab-rails-ce-fips, gemini-cli, serve, nextcloud-server, unleash-proxy, arangodb, renovate, librechat, yaml-language-server...
GHSA-7P8R-X3MC-P8W7 vulnerabilities
Vulnerabilities for packages: prism, langfuse, vitess, saf, yaml-language-server, opensearch-dashboards, renovate, argo-workflows, serve...
CVE-2026-18446 vulnerabilities
Vulnerabilities for packages: prism, langfuse, vitess, saf, yaml-language-server, opensearch-dashboards, renovate, argo-workflows, serve...
GHSA-FXQJ-RQCC-2CMP vulnerabilities
Vulnerabilities for packages: langfuse, vitess, saf, kubeflow-pipelines, nextcloud-server, renovate...
CVE-2026-69153 vulnerabilities
Vulnerabilities for packages: langfuse, vitess, saf, kubeflow-pipelines, nextcloud-server, renovate...
CVE-2026-15157 vulnerabilities
Vulnerabilities for packages: prism, langfuse, npm, vitess, saf, renovate, pulumi, code-server...