112557 matches found
CVE-2026-45181
creationtimestamp| type| source ---|---|--- 2026-05-10 01:19:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlhlqtpypx2t...
CVE-2026-45182
creationtimestamp| type| source ---|---|--- 2026-05-10 01:09:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlhl6wvexz2e...
PT-2026-41196
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.5 Description The validate url function in backend/open webui/retrieval/web/utils.py only validates the initial URL provided by the user. Downstream HTTP clients, including sync requests, async aiohttp, and...
WordPress plugin IP2Location Country Blocker 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...
WordPress plugin Picture Gallery 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
PT-2026-41195
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.5 Description A parsing discrepancy between the urlparse and requests libraries allows for a Server-Side Request Forgery SSRF bypass. The validate url function uses urlparse to verify the hostname; however,...
CVE-2026-45345
creationtimestamp| type| source ---|---|--- 2026-05-09 22:10:27+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-gm54-m39w-grjp 2026-05-16 01:15:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlwocnrknq2e...
CVE-2026-8194
creationtimestamp| type| source ---|---|--- 2026-05-09 22:05:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlhaua5h5m2i...
CVE-2026-42257
creationtimestamp| type| source ---|---|--- 2026-05-09 21:40:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlh7iqqghk2r 2026-05-10 12:01:25+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mliplujde42d 2026-07-18 12:01:11+00:00| seen|...
CVE-2026-8198
creationtimestamp| type| source ---|---|--- 2026-05-09 15:05:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlgjfi7j3n2i 2026-05-10 01:36:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116547714758316244 2026-05-11 01:33:05+00:00| seen|...
CVE-2026-3828
creationtimestamp| type| source ---|---|--- 2026-05-09 10:01:57+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mlfyhby4gg2x 2026-05-09 12:40:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlgbby5j6r2p...
CVE-2025-15634
creationtimestamp| type| source ---|---|--- 2026-05-09 08:56:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfurthfhv2n...
CVE-2026-45315
creationtimestamp| type| source ---|---|--- 2026-05-09 08:02:50+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-m8f9-9whg-f4xr 2026-05-16 04:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlwxioao4w2c...
CVE-2025-15634
A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page...
CVE-2026-7652
creationtimestamp| type| source ---|---|--- 2026-05-09 05:41:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfjwhj6lf2p 2026-05-10 20:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mljm6sv5v42x...
GHSA-MV93-W799-CJ2W
creationtimestamp| type| source ---|---|--- 2026-05-09 05:40:29+00:00| seen| https://gist.github.com/alon710/be4c0540ec919d713e0bd6ccf621615c...
Server-Side Request Forgery
Weblate is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to missing validation of repository URLs during project backup import, where Component.objects.bulkcreate bypasses Django fullclean validation and allows attacker-controlled repository URLs to be written into...
CVE-2026-8209
creationtimestamp| type| source ---|---|--- 2026-05-09 05:26:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfj3m6ba52e...