110981 matches found
CVE-2026-45100
creationtimestamp| type| source ---|---|--- 2026-08-04 22:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbzwjdqcj2z...
CVE-2026-18813
creationtimestamp| type| source ---|---|--- 2026-08-04 21:49:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2lkjejcezmnlb...
CVE-2026-54020
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticat...
GHSA-8X5V-CPV7-8JJP
creationtimestamp| type| source ---|---|--- 2026-08-04 20:31:40+00:00| seen| https://gist.github.com/alon710/a07f9786cabb1f06c1eba431ddd448e4...
CVE-2026-18811
Affected product: H3C NX15 V100R017. Vulnerable component: the Add function in /api/esps, where manipulating esps.filter.url leads to command injection. Impact: remote exploitation with high severity (per CVSS metrics). Exploit status: public; vendor was contacted early about disclosure. No remed...
EUVD-2026-52896
A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The...
CVE-2026-67592
creationtimestamp| type| source ---|---|--- 2026-08-04 20:12:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/7p5nbufssz34w...
CVE-2026-70552
creationtimestamp| type| source ---|---|--- 2026-08-04 20:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbt4erihi2b...
CVE-2026-14557
creationtimestamp| type| source ---|---|--- 2026-08-04 19:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbpjwv3wf2l...
CVE-2026-66274
creationtimestamp| type| source ---|---|--- 2026-08-04 18:27:39+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/beyivykax7nj3...
CVE-2026-64633
creationtimestamp| type| source ---|---|--- 2026-08-04 18:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbmxphvf72i 2026-08-05 07:30:40+00:00| seen| https://bsky.app/profile/newsfacts.bsky.social/post/3mscyzs666b2b 2026-08-05 12:28:03+00:00| seen|...
CVE-2026-63456
creationtimestamp| type| source ---|---|--- 2026-08-04 18:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbmu3v6f52u 2026-08-05 13:05:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msdlqavcqi2u 2026-08-13 14:38:45+00:00| seen|...
CVE-2026-63455
creationtimestamp| type| source ---|---|--- 2026-08-04 18:18:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbmqkotdv2u 2026-08-05 13:05:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msdlqavcqi2u 2026-08-13 14:38:45+00:00| seen|...
CVE-2026-47615
NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure...
CVE-2026-24253
creationtimestamp| type| source ---|---|--- 2026-08-04 18:00:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gacjtlujv4rab...
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...
CVE-2026-70473
Flowise (a UI for building LLM workflows) prior to version 3.1.3 exposed a server-wide upsert-history via GET /api/v1/upsert-history. The endpoint returned data scoped to none of the requester’s identity (user/tenant/workspace) and could exceed 100 MB, including sensitive configuration data such ...
CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...
CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...