glances 安全漏洞

Glances is a system monitoring tool developed by Nicolas Hennion. Versions of Glances prior to 4.5.2 contained security vulnerabilities. These vulnerabilities stemmed from the lack of application-level host permission checks in REST/WebUI applications. This could lead to DNS redirection attacks,...

CVE-2026-32632: Origin Validation Error

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

CVE-2026-22316: Stack-based Buffer Overflow

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack...

CVE-2025-15552

CVE-2025-15552 affects Truesec LAPSWebUI prior to version 2.4. The root cause is insufficient session expiration, which can allow a workstation-occupied attacker to escalate privileges by disclosure of the local admin password. The available connected sources corroborate a local-attack vector wit...

arches-containers (>=1.1.0a1, <=1.1.2), arthexis (>=0.1.14, <=0.1.30) +15 more potentially affected by CVE-2026-32274 via black (25.9.0)

black PYPI version 25.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - arches-containers =1.1.0a1, =0.1.14, =19.0.7, =0.1.48, =0.0.59, =0.1.2, =2.179.0, =0.6.35, =0.0.1, =1.7.0, =2.1.0 and more Source cves: CVE-2026-3227...

EUVD-2026-11145

A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaaportalauthlocalsubmit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit has been made public and could be used...

CVE-2025-15603

A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...

CVE-2026-3943: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaaportalauthlocalsubmit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit has been made public and could be used...

EUVD-2025-208452

A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...

GHSA-2RF6-9RC8-RQCH Withdrawn Advisory: Open WebUI JWT Key Handler

Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...

Withdrawn Advisory: Open WebUI JWT Key Handler

Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...

CVE-2025-15603

Open WebUI up to version 0.6.16 is reported to contain a security issue in the JWT Key Handler, specifically in the file backend/start_windows.bat. Manipulating the WEBUI_SECRET_KEY argument can lead to insufficient randomness in keys, potentially enabling remote exploitation. Multiple connected ...

CVE-2025-15603

...

CVE-2025-15603

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, startwindows.ba...

Open WebUI 安全特征问题漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI with open-source code. Versions of Open WebUI prior to 0.6.16 have a security vulnerability related to the parameter WEBUISECRETKEY, where insufficient randomness was present in the handling of this parameter...

GHSA-2G6R-C272-W58R vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-28351 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-F2V5-7JQ9-H8CG vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-F2V5-7JQ9-H8CG vulnerabilities

Vulnerabilities for packages: open-webui, litellm, nemo...

CVE-2026-25136

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessa...