28789 matches found
GHSA-RQJ7-6WRP-6G2G Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
Summary POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in editimage tool,...
EUVD-2026-42616
Open WebUI: Stored web worker XSS via Pyodide...
GHSA-W28W-GP39-M4P6 Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Summary The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. Affected packages - npm...
Cross-site Scripting (XSS)
Overview trix is a Rich Text Editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the HTMLParser process. An attacker can inject malicious scripts by pasting crafted HTML containing a span element with an empty data-trix-attachment attribute, which bypasses...
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Summary A type confusion issue in seroval.fromJSON allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications...
EUVD-2026-44937
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Summary Microsoft Kiota resolved OpenAPI $refs by fetching remote https URLs and reading local files including absolute / out-of-tree paths, inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary...
EUVD-2026-48665
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-65693
Microweber CMS up to version 2.0.20 exposes a server-side template injection in mail templates via Twig in TwigView::render(). The unsandboxed Twig environment, lacking SandboxExtension or a SecurityPolicy, allows authenticated administrators to inject Twig expressions (e.g., filter('system')) in...
CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-65693
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-57106
Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-48606
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...
EUVD-2026-48601
Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...
SUSE-SU-2026:3245-1 Security update for python3
This update for python3 fixes the following issues: - CVE-2026-7210: insufficient entropy used for Expat hash-flooding protection allows a crafted XML document to trigger hash flooding bsc1264962. - CVE-2026-8328: server-supplied PASV host address is trusted by ftpcp and allows for SSRF bsc126526...
OESA-2026-3152 wget security update
GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: GNU Wget does n...
WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin AffiliateX versions = 2.3.5...
Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.
Summary IBM ApplinX has been updated in order to address multiple vulnerabilities CVE-2026-50170, CVE-2026-50171, CVE-2026-54266, CVE-2026-54268, CVE-2026-53404, CVE-2026-55956, CVE-2026-53434, CVE-2026-55276, CVE-2018-1000665, CVE-2026-50557, CVE-2026-54265, CVE-2026-52725, CVE-2026,...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty
Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-11714 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3...