CVE-2026-32632 Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

Malicious code in ui-core_mal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c66ea54316ebd799590186156adab4ff03ad3108487b4c5c48192924efcd60a The package ui-coremal was found to contain malicious code...

MAL-2026-1870 Malicious code in ui-core_mal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c66ea54316ebd799590186156adab4ff03ad3108487b4c5c48192924efcd60a The package ui-coremal was found to contain malicious code...

MAL-2026-1743 Malicious code in haodesk-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d84a56e7e332520633c65a2690e70d5eb4792907c98da8a7d6830a463438c7d2 The package haodesk-ui was found to contain malicious code...

Malicious code in haodesk-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d84a56e7e332520633c65a2690e70d5eb4792907c98da8a7d6830a463438c7d2 The package haodesk-ui was found to contain malicious code...

MAL-2026-1703 Malicious code in dataterminal-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5edeeb534b27862802b775a378680a4755cccb09d13481c4525f63821bd81d The package dataterminal-ui was found to contain malicious code...

Malicious code in dataterminal-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5edeeb534b27862802b775a378680a4755cccb09d13481c4525f63821bd81d The package dataterminal-ui was found to contain malicious code...

Malicious code in @legacy-ui/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc68fa0af265da13a26ccfc943668c887b5aa3f4a73ddc7af9ab2d8498d7a0d The package @legacy-ui/core was found to contain malicious code...

MAL-2026-1628 Malicious code in @legacy-ui/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc68fa0af265da13a26ccfc943668c887b5aa3f4a73ddc7af9ab2d8498d7a0d The package @legacy-ui/core was found to contain malicious code...

Malicious code in @cbreone/survey-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa512020ca8dd602c54abcdc6b69379bc5656423a35dabd5200db0e3b8af7fd6 The package @cbreone/survey-ui was found to contain malicious code...

MAL-2026-1592 Malicious code in @cbreone/survey-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa512020ca8dd602c54abcdc6b69379bc5656423a35dabd5200db0e3b8af7fd6 The package @cbreone/survey-ui was found to contain malicious code...

MAL-2026-1591 Malicious code in @cbreone/micro-ui-survey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d740150668055ded0e2a179405c28d897f9ad333829b48a26892be6e8d6e3f27 The package @cbreone/micro-ui-survey was found to contain malicious code...

Malicious code in @cbreone/micro-ui-survey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d740150668055ded0e2a179405c28d897f9ad333829b48a26892be6e8d6e3f27 The package @cbreone/micro-ui-survey was found to contain malicious code...

Malicious code in @cbreone/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7e204888ba2b9573e474d804f28f51173684bb25f640615a9eaae217c5e1a45 The package @cbreone/core-ui was found to contain malicious code...

BIT-AIRFLOW-2026-28563 Apache Airflow: DAG authorization bypass

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to...

GHSA-HQMH-PPP3-XVM7 vulnerabilities

Vulnerabilities for packages: open-webui...

PT-2026-26182

Name of the Vulnerable Software and Affected Versions Mesop versions 1.2.2 and below Description Mesop, a Python-based UI framework, contains a Path Traversal vulnerability. This allows a user providing an untrusted state token through the UI stream payload to target files on the disk when using...

org.webjars.npm:browser-sync-ui (2.27.11), org.webjars.npm:nestjs__platform-socket.io (9.0.0-next.2) +3 more potentially affected by CVE-2026-33151 via org.webjars.npm:socket.io-parser (>=2.3.1, <=4.2.5)

org.webjars.npm:socket.io-parser MAVEN version =2.3.1, =0.3.1, =0.5.0 - org.webjars.npm:socket.io-client 4.8.3 Source cves: CVE-2026-33151 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15680279...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource in the /ui/dependencies endpoint, which returns the complete DAG dependency graph without verifying authorized DAG IDs. An attacker can gain unauthorized access to information about...

EUVD-2026-12564

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to...