CVE-2026-33340 LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint

LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery SSRF vulnerability has been identified in all known existing versions of lollms-webui. The @router.post"/api/proxy" endpoint allows unauthenticated attackers to...

CVE-2026-33340

LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery SSRF vulnerability has been identified in all known existing versions of lollms-webui. The @router.post"/api/proxy" endpoint allows unauthenticated attackers to...

CVE-2026-33340: Missing Authentication for Critical Function

LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery SSRF vulnerability has been identified in all known existing versions of lollms-webui. The @router.post"/api/proxy" endpoint allows unauthenticated attackers to...

PT-2026-27456

Name of the Vulnerable Software and Affected Versions LoLLMs WEBUI affected versions not specified Description LoLLMs WEBUI, the web user interface for Lord of Large Language and Multi modal Systems, contains a Server-Side Request Forgery SSRF issue. An unauthenticated attacker can exploit this t...

CVE-2026-32632

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

UBUNTU-CVE-2026-32632

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

CVE-2026-32632

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

MAL-2026-1588 Malicious code in @bingads-webui-help/apex.core.v3.min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87351101634ee5726eaa0ee76ecaec8529226c993a610ea5a2d1b7521778bd5a The package @bingads-webui-help/apex.core.v3.min was found to contain malicious code...

Malicious code in @bingads-webui-cc-react/edit-primary-contact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8db2de62135603996e4dfafbfd49878df32f1d35291bd473c636cef7b7303f6 The package @bingads-webui-cc-react/edit-primary-contact was found to contain malicious code...

MAL-2026-1587 Malicious code in @bingads-webui-cc-react/edit-primary-contact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8db2de62135603996e4dfafbfd49878df32f1d35291bd473c636cef7b7303f6 The package @bingads-webui-cc-react/edit-primary-contact was found to contain malicious code...

CVE-2026-22316

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack...

CVE-2026-22316 Buffer Overflow using TFTP Filename

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack...

CVE-2026-31826 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-32597 vulnerabilities

Vulnerabilities for packages: ggshield, kserve, datadog-agent, py3-cassandra-medusa, semgrep, az, superset, airflow, open-webui...

GHSA-752W-5FWX-JX9F vulnerabilities

Vulnerabilities for packages: ggshield, kserve, datadog-agent, py3-cassandra-medusa, semgrep, az, superset, airflow, open-webui...

GHSA-3936-CMFR-PM3M vulnerabilities

Vulnerabilities for packages: kserve, open-webui...

CVE-2026-32274 vulnerabilities

Vulnerabilities for packages: kserve, open-webui...

glances 安全漏洞

Glances is a system monitoring tool developed by Nicolas Hennion. Versions of Glances prior to 4.5.2 contained security vulnerabilities. These vulnerabilities stemmed from the lack of application-level host permission checks in REST/WebUI applications. This could lead to DNS redirection attacks,...

CVE-2026-22316: Stack-based Buffer Overflow

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack...

CVE-2026-32632: Origin Validation Error

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...