openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45299 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45299 Source advisory: SNYK:PYTHON-OPENWEBUI-16874117...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45299 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45299 Source advisory: GHSA-6GH2-Q7CP-9QF6...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45299 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45299 Source advisory: OSV:GHSA-6GH2-Q7CP-9QF6...

agrisoln (1.0.0), drafty (>=0.1.14, <=0.2.37) +1 more potentially affected by unknown CVE via react-svg (>=2.1.10, <=2.1.22)

react-svg NPM version =2.1.10, =0.1.14, =0.2.37 - pcs-remote-monitoring-webui 1.0.0 Source cves: unknown CVE Source advisory: MEND:WS-2018-0109...

PT-2026-41176

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.31 Description A Cross-Site Scripting issue exists in the SVG renderer implementation. This allows the permanent storage of HTML or JavaScript code within the application, which is then executed in the context ...

EUVD-2026-30109

Hermes WebUI prior to 0.51.44 - Release T contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the...

CVE-2026-22677

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace fie...

CVE-2026-22677

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace fie...

CVE-2026-22677

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace fie...

CVE-2026-22677 Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace fie...

CVE-2026-22677

Hermes WebUI prior to version 0.51.44 (Release T) contains a path traversal vulnerability in the session import endpoint . An authenticated attacker can import a crafted session with an unrestricted workspace value, allowing access to arbitrary files readable by the WebUI process. Attackers can s...

CVE-2026-22677: Improper Limitation of a Pathname to a Restricted Directory

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by importing a crafted session with an unrestricted workspace value. Attackers can supply a blocked filesystem root in the workspace fie...

ch.sbb.releasetrain:jsfbootadapter (>=0.0.25, <=0.9.6), ch.sbb.releasetrain:webui (0.0.25) +183 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.0.36)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.36 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.sbb.releasetrain:jsfbootadapter =0.0.25, =0.9.6 - ch.sbb.releasetrain:web...

ch.sbb.releasetrain:jsfbootadapter (>=0.0.25, <=0.9.6), ch.sbb.releasetrain:webui (0.0.25) +183 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.0.36)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.36 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.sbb.releasetrain:jsfbootadapter =0.0.25, =0.9.6 - ch.sbb.releasetrain:web...

ch.sbb.releasetrain:jsfbootadapter (>=0.0.25, <=0.9.6), ch.sbb.releasetrain:webui (0.0.25) +183 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.0.36)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.36 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.sbb.releasetrain:jsfbootadapter =0.0.25, =0.9.6 - ch.sbb.releasetrain:web...

CVE-2025-15634

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page...

CVE-2025-15633

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data site names, versions, and configuration variables and bypass privilege requirements via unprotected endpoints lacking adequate security headers...

CVE-2026-44226

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/ is reachable without authentication and renders attacker-controlled template names, an...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44570 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44570 Source advisory: GHSA-HMJQ-CRXP-7RJW...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44570 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44570 Source advisory: OSV:GHSA-HMJQ-CRXP-7RJW...