5136 matches found
OS command injection on vmimages update feature
...
PT-2026-41179
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description An issue exists where a user can continue the conversation of another user if the target user's Chat ID is known. This occurs because the system fails to verify if the Chat ID matches the user who...
IBM InfoSphere Data Architect 跨站脚本漏洞
IBM InfoSphere Data Architect is a data modeling and database design development tool provided by the American multinational company IBM. Version 9.2.1 of IBM InfoSphere Data Architect contains a cross-site scripting vulnerability. This vulnerability stems from allowing unauthenticated attackers ...
CVE-2025-15603
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh...
PT-2026-24109
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/start windows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUI SECRET KEY leads to insufficiently random values. It is possible to launch the...
Malicious Package
Overview chronos-web-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
CVE-2026-3343
A reflected cross-site scripting XSS vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link...
CVE-2026-3343
A reflected cross-site scripting XSS vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link. This vulnerability affects Fireware OS 12.7 up to and including 12.11.7...
CVE-2026-3343 WatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UI
A reflected cross-site scripting XSS vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link...
CVE-2026-3343 WatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UI
A reflected cross-site scripting XSS vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link...
GHSA-2RW7-X74F-JG35 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-2G6R-C272-W58R vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-2RW7-X74F-JG35 vulnerabilities
Vulnerabilities for packages: open-webui...
WatchGuard Fireware OS 安全漏洞
WatchGuard Fireware OS is a software operated by the American company WatchGuard, running on Firebox devices. Versions 12.7 to 12.11.7 and 2025.1 to 2026.1.1 of WatchGuard Fireware OS contain security vulnerabilities. These vulnerabilities stem from reflective cross-site scripting in the Fireware...
CVE-2026-28351 vulnerabilities
Vulnerabilities for packages: open-webui, litellm, nemo...
CVE-2026-27628 vulnerabilities
Vulnerabilities for packages: open-webui...
@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8), @manniwatch/client-desktop (>=0.30.0, <=0.30.1) +3 more potentially affected by CVE-2026-27739 via @angular/ssr (>=19.0.5, <=19.2.19)
@angular/ssr NPM version =19.0.5, =1.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2026-27739 Source advisory: OSV:GHSA-X288-3778-4HHX...
@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8), @manniwatch/client-desktop (>=0.30.0, <=0.30.1) +3 more potentially affected by CVE-2026-27738 via @angular/ssr (>=19.0.5, <=19.2.19)
@angular/ssr NPM version =19.0.5, =1.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2026-27738 Source advisory: SNYK:JS-ANGULARSSR-15357598...