GHSA-996Q-PR4M-CVGQ vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-27025 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-27205 vulnerabilities

Vulnerabilities for packages: airflow, mitmproxy, emissary, open-webui, mlflow, airflow-core, kubeflow-volumes-web-app...

CVE-2025-33135

This CVE affects IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform releases 3.0.0.0 through 3.0.5.4 Interim Fix 027. The issue is a cross-site scripting vulnerability in the Web UI that allows an unauthenticated attacker to embed arbitrary JavaScript, potent...

CVE-2026-26013 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-1571 Reflected XSS Vulnerability on TP-Link Archer C60

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended...

PT-2026-7478

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended...

Oracle Linux 10 : pcs (ELSA-2026-2438)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-2438 advisory. 0.12.1-1.el101.2 - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.23.1 Resolves: RHEL-144292 Tenable has extracted the preceding description block directly...

Oracle Linux 9 : pcs (ELSA-2026-2452)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-2452 advisory. 0.11.10-1.el97.2 - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.23.1 Resolves: RHEL-144292 Tenable has extracted the preceding description block directly...

pcs security update

0.11.10-1.el97.2 - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.23.1 Resolves: RHEL-144292...

pcs security update

0.12.1-1.el101.2 - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.23.1 Resolves: RHEL-144292...

CVE-2026-25640

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL...

Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL

Summary A Path Traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling the...

PT-2026-6789

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.34.0 through 1.50.9 Description Pydantic AI contains a path traversal issue in its web UI. A crafted URL can be used by an attacker to serve arbitrary JavaScript within the application's context. This allows execution of...

GHSA-F632-VM87-2M2F qdrant has arbitrary file write via `/logger` endpoint

Summary It is possible to append to arbitrary files via /logger endpoint. Minimal privileges are required read-only access. Tested on Qdrant 1.15.5 Details POST /logger Source code link endpoint accepts an attacker-controlled ondisk.logfile path. There are no authorization checks but authenticati...

CVE-2025-36436 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web...

LoLLMs WEBUI 安全漏洞

LoLLMs WEBUI is a large-scale model web user interface developed by Saifeddine ALOUI, which supports integration of multiple models and modalities. LoLLMs WEBUI has a security vulnerability; this vulnerability stems from the name parameter in the /reinstallextension endpoint containing local file...

CVE-2025-69929

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

CVE-2026-24431 Tenda W30E V2 Web UI Reveals Passwords in Cleartext

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 display stored user account passwords in plaintext within the administrative web interface. Any user with access to the affected management pages can directly view credentials...

CVE-2026-0782

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The specific fla...