5967 matches found
CVE-2026-32597 vulnerabilities
Vulnerabilities for packages: kserve, open-webui, az, ggshield, airflow, py3-cassandra-medusa, datadog-agent, semgrep, superset...
Glances security vulnerabilities
Glances is a system monitoring tool developed by Nicolas Hennion. Versions of Glances prior to 4.5.2 contained security vulnerabilities. These vulnerabilities stemmed from the lack of application-level host permission checks in REST/WebUI applications. This could lead to DNS redirection attacks,...
CVE-2026-32632: Origin Validation Error
Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...
CVE-2026-22316: Stack-based Buffer Overflow
A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack...
CVE-2025-15552
CVE-2025-15552 affects Truesec LAPSWebUI prior to version 2.4. The root cause is insufficient session expiration, which can allow a workstation-occupied attacker to escalate privileges by disclosure of the local admin password. The available connected sources corroborate a local-attack vector wit...
arches-containers (>=1.1.0a1, <=1.1.3rc1), arthexis (>=0.1.14, <=0.1.30) +14 more potentially affected by CVE-2026-32274 via black (25.9.0)
black PYPI version 25.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - arches-containers =1.1.0a1, =0.1.14, =19.0.7, =0.1.48, =0.0.59, =0.1.2, =2.179.0, =0.0.1, =1.7.0, =2025.35.0, =2026.55.0 and more Source cves:...
arches-containers (>=1.1.0a1, <=1.1.3rc1), arthexis (>=0.1.14, <=0.1.30) +14 more potentially affected by CVE-2026-31900 via black (25.9.0)
black PYPI version 25.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - arches-containers =1.1.0a1, =0.1.14, =19.0.7, =0.1.48, =0.0.59, =0.1.2, =2.179.0, =0.0.1, =1.7.0, =2025.35.0, =2026.55.0 and more Source cves:...
arthexis (>=0.1.31, <=0.1.34), dismo (0.2.43) +6 more potentially affected by CVE-2026-31900 via black (25.11.0)
black PYPI version 25.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - arthexis =0.1.31, =2.184.0, =1.59.0, =0.2.4, =1.0.0rc1, =1.0.0 - qtbmodels 0.1.0 Source cves: CVE-2026-31900 Source advisory: OSV:PYSEC-2026-2120...
EUVD-2026-11145
A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaaportalauthlocalsubmit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit has been made public and could be used...
CVE-2025-15603
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...
CVE-2026-3943: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaaportalauthlocalsubmit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit has been made public and could be used...
Withdrawn Advisory: Open WebUI JWT Key Handler
Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...
EUVD-2025-208452
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...
GHSA-2RF6-9RC8-RQCH Withdrawn Advisory: Open WebUI JWT Key Handler
Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...
CVE-2025-15603
Open WebUI up to version 0.6.16 is reported to contain a security issue in the JWT Key Handler, specifically in the file backend/start_windows.bat. Manipulating the WEBUI_SECRET_KEY argument can lead to insufficient randomness in keys, potentially enabling remote exploitation. Multiple connected ...
CVE-2025-15603
...
CVE-2025-15603
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, startwindows.ba...
Open WebUI Security Feature Vulnerability
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI with open-source code. Versions of Open WebUI prior to 0.6.16 have a security vulnerability related to the parameter WEBUISECRETKEY, where insufficient randomness was present in the handling of this parameter...
